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On  February  8,  1997,  about  1935  Atlantic  standard  time,  a  Cessna  402,  N318AB,  operating 
under  the  provisions  of  Title  14  Code  of  Federal  Regulations  (CFR)  Part  135  as  Air  Sunshine 
flight  319,  crashed  into  the  Caribbean  Sea  southwest  of  St.  Thomas,  U.S.  Virgin  Islands.  The  flight 
had  been  a  regularly  scheduled  flight  operating  under  visual  flight  rules  (VFR)  between  St.  Thomas  and 
St.  Croix.  The  airplane  was  destroyed;  two  passengers  were  killed,  and  the  pilot  and  two  of  the 
remaining  four  passengers  sustained  minor  injuries.  Night,  visual  meteorological  conditions  prevailed 
at  the  time. 


The  pilot,  who  had  accrued  over  1 1 ,000  hours  in  the  400-series  Cessna  airplane  types,  mostly 
in  the  south  Florida  area,  had  begun  flying  in  the  Caribbean  area  less  than  a  week  before  the  accident. 
The  pilot  estimated  that  he  had  executed  between  10  and  15  approaches  to  St.  Thomas,  with  4  or  5  of 
those  at  night.  The  pilot  told  Safety  Board  investigators  that,  at  the  time  of  the  accident,  he  was  unable 
to  receive  the  distance  measuring  equipment1  signal  from  St.  Thomas.  Consequently,  he  was  especially 
attentive  to  receiving  and  establishing  the  proper  localizer2  course  to  St.  Thomas  to  remain  clear  of  the 
mountains  on  the  north  side  of  the  island.  The  pilot  said  that  he  encountered  some  difficulties  receiving 
the  radio  signal  and  was  attempting  to  adjust  the  localizer  course  setting.  During  this  time,  the  pilot 
noticed  that  the  airplane  was  passing  through  1,100  feet  mean  sea  level.  The  pilot  said  that  he 
refocused  on  the  localizer  and  then  the  airplane  struck  the  water  about  3  miles  from  shore. 


According  to  the  pilot’s  account  of  the  accident,  the  sky  was  dark  and  few  or  no  lights  were 
visible  over  the  water.  The  evidence  suggests  that  the  absence  of  visual  cues  caused  by  the 
combination  of  dark  sky  and  darkness  over  the  water  produced  a  “black  hole”  effect  in  which  the  pilot 
lost  a  visual  sense  of  the  airplane’s  height  above  water.  As  a  result,  the  pilot  misjudged  the  airplane’s 
distance  from  the  island  and  height  above  the  water.  Further,  because  the  flight  was  conducted  under 


Distance  measuring  equipment  provides  accurate  information  on  the  distance  of  the  airplane  from  a  properly 
equipped  navigation  aid. 

2  The  localizer  is  a  component  of  the  instrument  landing  system  that  provides  the  pilot  with  lateral  information. 
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VFR,  the  pilot  had  no  assistance  from  air  traffic  control  (ATC)  regarding  proximity  to  the  surface, 
despite  the  approach  path  being  within  an  area  of  ATC  radar  coverage.  Had  the  pilot  operated  under 
instrument  flight  rules  (IFR),  radar  would  have  enabled  the  controller  to  monitor  the  flight’s  altitude,  as 
well  as  its  position. 

Radar  advisories  were  also  available  to  flights  operating  under  VFR  in  the  St.  Thomas  area. 
However,  unlike  IFR  operations,  VFR  flights  do  not  operate  on  standard  routes  with  minimum  safe 
altitudes  that  are  published  for  pilots  and  controllers  to  use.  As  a  result,  controllers  do  not  have  a 
criterion  for  identifying  VFR  flights  that  are  operating  at  unsafe  altitudes.  Further,  the 
St.  Thomas  ATC  facility  incorporated  the  minimum  safe  altitude  warning  (MSAW)  system,  which  is 
designed  to  alert  a  controller  if  an  airplane  descends  prematurely  toward  terrain  or  water.  However,  to 
reduce  the  frequency  of  nuisance  MSAW  alerts  from  VFR  flights  operating  below  minimum  IFR 
altitudes,  the  St.  Thomas  ATC  radar  MSAW  system  was  configured  by  the  Federal  Aviation 
Administration  (FAA)  to  alert  controllers  only  about  flights  operating  under  IFR. 
The  Safety  Board  notes  that  the  FAA’s  configuration  of  the  MSAW  to  exclude  VFR  operations  is  not 
unique  to  the  St.  Thomas  ATC  facility. 

Although  current  rules  allow  aircraft  used  to  provide  scheduled  passenger  services  under 
14  CFR  Part  135  (aircraft  with  fewer  than  10  passenger  seats)  to  be  operated  under  VFR,  the  Safety 
Board  is  concerned  that  visual  flight  operations  at  night  may  impose  incremental  risks  on  users  of  these 
services.  The  hazards  of  night  flight  over  large  bodies  of  water  have  been  recognized  by  the  FAA  and 
addressed  in  its  Aeronautical  Information  Manual  (AIM).  The  AIM  section  titled  “Official  Guide  to 
Basic  Flight  Information  and  ATC  Procedures”  states  the  following: 

Featureless  terrain  illusion — An  absence  of  ground  features,  as  when  landing  over 
water,  darkened  areas,  and  terrain  made  featureless  by  snow,  can  create  the  illusion  that 
the  aircraft  is  at  a  higher  altitude  than  it  actually  is.  The  pilot  who  does  not  recognize 
this  illusion  will  fly  a  lower  approach. 

The  Safety  Board  previously  addressed  the  risks  of  operating  scheduled  passenger  flights 
under  VFR  in  its  investigation  of  a  1989  accident  involving  a  DeHavilland  DHC  6-300,  conducted 
under  14  CFR  Part  135,  that  crashed  into  the  side  of  a  mountain  in  Molokai,  Hawaii,  while  the  pilot 
was  attempting  to  operate  under  VFR  during  IFR  conditions?  As  a  result  of  that  accident,  in  Safety 
Recommendation  A-90-137,  the  Safety  Board  urged  the  FAA  to  require  that  scheduled 
14  CFR  Part  135  operations  of  turbine-powered  or  multiengine  airplanes  be  conducted  under  IFR 
during  hours  of  darkness  or  whenever  visibilities  less  than  3  miles  or  ceilings  less  than  1 ,000  feet  are 
forecast,  reported,  or  encountered.  The  FAA  replied  to  the  Safety  Board  that  it  agreed  with  the  intent 
of  the  recommendation.  In  1996,  the  FAA  further  responded  to  the  Safety  Board  by  citing  the 
promulgation  of  the  commuter  rule,  which  changed  the  regulatory  basis  of  scheduled  passenger 
operations  using  aircraft  with  10  or  more  passenger  seats  from  14  CFR  Part  135  to  Part  121. 
Based  on  this  action  and  the  existing  Part  121  restrictions  on  VFR  operations,  on  July  15, 1996,  Safety 
Recommendation  A-90-137  was  classified  “Closed — Acceptable  Action.” 


3  See  Aloha  IslandAir,  Inc.,  Flight  1712,  DeHavilland  Twin  Otter,  DHC-6-300,  N707PV,  Halawa  Point,  Molokai, 
Hawaii,  October  28,  1989.  Aviation  Accident  Report  NTSB/AAR-90/05.  Washington,  DC. 


3 


Although  the  FAA’s  action  in  response  to  Safety  Recommendation  A-90-137  has  continued  to 
be  effective  for  operations  that  use  10-seat  and  larger  aircraft,  the  St.  Thomas  accident  indicates  that 
VFR  operations  at  night  continue  to  pose  a  hazard  to  passengers  on  scheduled  flights  that  use  smaller 
aircraft.  Passengers  on  these  flights  should  be  provided  the  additional  safety  benefits  that  result 
from  using  IFR  procedures  and  receiving  radar  traffic  and  terrain  advisories  when  their  flights  are 
operated  at  night.  These  benefits  include  the  restriction  of  operations  to  published  routes  or  areas 
4  where  ATC  can  provide  radar  vectors  and  the  MSAW  system.  Most  14  CFR  Part  135  scheduled 

passenger  flights  should  be  able  to  operate  under  IFR.  However,  the  Safety  Board  recognizes  that 
some  of  these  flights  may  not  be  able  to  operate  under  IFR  because  of  the  lack  of  necessary  ground 
navigational  aids  and  instrument  approach  procedures  or  the  characteristics  of  the  airplanes  being  used. 
(Commercial,  passenger-carrying  operations  are  not  permitted  to  fly  under  IFR  in  many  single-engine 
airplane  types.) 

Therefore,  the  National  Transportation  Safety  Board  makes  the  following 
recommendation  to  the  Federal  Aviation  Administration: 

Require  all  14  Code  of  Federal  Regulations  Part  135  scheduled  passenger  flights  that 
are  operated  at  night  to  be  conducted  under  instrument  flight  rules,  with  any  exceptions 
to  be  provided  in  air  carrier  operations  specifications  on  a  route-by-route  basis  when 
instrument  flight  rules  operations  are  found  to  be  unfeasible.  (A-98-87) 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMIDT,  GOGLIA, 
and  BLACK  concurred  in  this  recommendation. 
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National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 

Date:  November  30,  1998 

In  reply  refer  to:  A-98-88  through  -106 


Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


About  1554  eastern  standard  time,1  on  January  9,  1997,  an  Empresa  Brasileira  de 
Aeronautica,  S/A  (Embraer)  EMB-120RT,  N265CA,  operated  by  COMAIR  Airlines,  Inc.,2  as 
flight  3272,  crashed  during  a  rapid  descent  after  an  uncommanded  roll  excursion  near  Monroe, 
Michigan.  Comair  flight  3272  was  being  operated  under  the  provisions  of  Title  14  Code  of 
Federal  Regulations  (CFR)  Part  135  as  a  scheduled,  domestic  passenger  flight  from  the 
Cincinnati/Northem  Kentucky  International  Airport  (CVG),  Covington,  Kentucky,  to  Detroit 
Metropolitan/Wayne  County  Airport  (DTW),  Detroit,  Michigan.  The  flight  departed  CVG  about 
1508,  with  2  flightcrew  members,  1  flight  attendant,  and  26  passengers  on  board.  There  were  no 
survivors.  The  airplane  was  destroyed  by  ground  impact  forces  and  a  postaccident  fire. 
Instrument  meteorological  conditions  prevailed  at  the  time  of  the  accident,  and  flight  3272  was 
operating  on  an  instrument  flight  rules  flight  plan. 

The  National  Transportation  Safety  Board  determined  that  the  probable  cause  of  this 
accident  was  the  Federal  Aviation  Administration’s  (FAA)  failure  to  establish  adequate  aircraft 
certification  standards  for  flight  in  icing  conditions,  the  FAA’s  failure  to  ensure  that  a  Centro 
Tecnico  Aeroespacial/F AA-approved  procedure  for  the  accident  airplane’s  deice  system  operation 
was  implemented  by  U.S.-based  air  carriers,  and  the  FAA’s  failure  to  require  the  establishment  of 
adequate  minimum  airspeeds  for  icing  conditions,  which  led  to  the  loss  of  control  when  the 
airplane  accumulated  a  thin,  rough  accretion  of  ice  on  its  lifting  surfaces. 3 


1  Unless  otherwise  indicated,  all  times  are  eastern  standard  time,  based  on  a  24-hour  clock. 

2  Within  this  safety  recommendation  letter,  COMAIR  Airlines,  Inc.,  will  be  identified  as  Comair. 

3  National  Transportation  Safety  Board.  1998.  In-Flight  Icing  Encounter  and  Uncontrolled  Collision 
With  Terrain,  Comair  Flight  3272,  Embraer  EMB-120RT,  N265CA,  Monroe,  Michigan,  January  9,  1997.  Aircraft 
Accident  Report  NTSB/AAR-98/04.  Washington,  DC. 
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Summary  of  Accident  Sequence 

According  to  cockpit  voice  recorder  (CVR)  and  air  traffic  control  (ATC)  information, 
during  the  20  minutes  preceding  the  accident,  the  pilots  received  a  series  of  clearances  from  ATC 
that  included  descent,  airspeed,  and  heading  instructions.  Flight  data  recorder  (FDR)  and  radar 
data  indicated  that  the  airplane’s  descent  from  the  en  route  cruise  altitude  of  flight  level  210  to 
4,000  feet  mean  sea  level  (msl)  was  stable  and  controlled  and  was  accomplished  at  airspeeds  and 
headings  consistent  with  those  assigned  by  ATC.  Meteorological  information  and  pilot  reports  * 
indicated  that  the  airplane  was  probably  intermittently  in  clouds  as  it  descended  between  about 
1 1,000  feet  msl  and  8,200  feet  msl;  below  8,200  feet  msl,  the  airplane  was  probably  operating 
predominantly  in  the  clouds. 

The  pilots  were  operating  with  the  autopilot  engaged  during  the  descent.  They  had 
completed  the  descent  checklist  (including  the  activation  of  the  propeller  deicing  and  windshield 
heat  at  the  ice  protection  checklist  prompt)  and  the  first  four  of  the  six  items  on  the  approach 
checklist4  before  the  airplane  reached  4,000  feet  msl  during  its  descent.  At  1553:59,  when  the 
autopilot  was  leveling  the  airplane  at  4,000  feet  msl  on  a  heading  of  180°,  the  airplane  was  in  the 
clean  configuration  (no  flaps  or  gear  extended)  at  an  airspeed  of  about  166  knots  (the  pilots  were 
beginning  to  reduce  the  airspeed  to  the  ATC-assigned  airspeed  of  150  knots).  At  that  time,  ATC 
instructed  the  pilots  of  flight  3272  to  turn  left  to  a  heading  of  090°.  Shortly  after  the  pilots 
initiated  the  left  turn  (by  selecting  the  assigned  heading  for  the  autopilot),  the  airplane  reached  its 
selected  altitude  and  (at  1554:08)  the  autopilot  automatically  transitioned  to  the  altitude  hold 
mode.  As  the  autopilot  attempted  to  maintain  the  selected  altitude,  the  airplane’s  angle-of-attack 
(AO A)  began  to  increase  and  the  airspeed  continued  to  decrease;  at  1554:10,  the  autopilot  began 
to  trim  the  elevator  (pitch  trim)  to  an  increasingly  nose-up  position. 

The  accident  airplane’s  FDR  data  indicated  that  at  1554:10  the  airplane’s  left  bank 
steepened  beyond  20°  (moving  toward  the  autopilot’s  command  limit  in  the  heading  mode  of  25°, 

+/-  2.5°).  At  that  point  (according  to  the  autopilot  design  and  FDR  information),  the  roll  rate 
exceeded  that  required  by  the  autopilot’s  design  logic  to  achieve  the  commanded  roll  angle,  and 
the  autopilot’s  input  to  the  aileron  servos  moved  the  ailerons  (and  thus  the  airplane’s  control 
wheel)  in  the  right-wing-down  (RWD)  direction  to  counter  the  increasing  left  roll  rate.  FDR  data 
indicated  that,  during  the  next  3  seconds,  the  left  and  right  AOA  vanes  began  to  diverge, 
indicating  a  left  sideslip/yaw  condition,  and  the  lateral  acceleration  values  began  to  increase  to  the 
left  while  the  autopilot  increased  the  control  wheel  input  to  the  right  in  an  attempt  to  control  the 
roll.  Thus,  by  1554:10,  as  the  airspeed  decreased  through  155  knots,  the  airplane  experienced  the 
beginning  of  a  significant  asymmetry  in  the  lift  distribution  between  the  right  and  left  wings  and  an 
uncommanded  yaw  and  roll  to  the  left.5  The  roll  and  control  wheel  position  parameters  continued 
to  trend  in  opposite  directions,  and  the  left  and  right  AOA  vanes  continued  to  split  for  the  next  14 
seconds,  until  the  autopilot  disconnected  at  1554:24.125. 


4  According  to  several  Comair  EMB-120  pilots,  the  remaining  approach  checklist  items— flight 
attendants  notified  and  flaps,  15/15/checked — would  normally  be  accomplished  later  during  the  approach,  as  the 
airplane  neared  the  destination  airport. 

5  Evaluation  of  the  FDR  information  revealed  that  a  slight  asymmetry  of  lift  because  of  ice  existed  earlier 
in  the  flight;  however,  it  became  aerodynamically  significant  about  1554:10. 
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Just  after  1554:15,  as  the  airplane’s  airspeed  began  to  decrease  below  150  knots,  the 
pilots  began  to  increase  the  engine  power;6  however,  the  airplane’s  airspeed  continued  to 
decrease.  When  the  captain  drew  the  first  officer’s  attention  to  the  low  airspeed  indication  at 
1554:20.8,  the  airplane’s  airspeed  had  decreased  to  147  knots.  During  the  next  2  seconds,  the 
pilots  more  aggressively  increased  the  engine  power,  and  a  significant  torque  split  occurred;  the 
torque  values  peaked  at  108  percent  on  the  left  engine  and  138  percent  on  the  right  engine.  The 
Safety  Board  considered  several  possible  reasons  for  the  significant  torque  split,  including  uneven 
throttle  movement  by  the  pilots,  ice  ingestion  by  the  left  engine,  a  misrigged  engine,  or  an 
improper  engine  trim  adjustment  on  the  newly  installed  right  engine;  however,  it  was  not  possible 
to  positively  determine  the  cause  of  the  torque  split.  Postaccident  simulations  indicated  that  this 
torque  split  had  a  significant  yaw-producing  effect  at  a  critical  time  in  the  upset  event, 
exacerbating  the  airplane’s  excessive  left  roll  tendency.  The  airplane’s  airspeed  decreased  further 
to  146  knots,  the  left  roll  angle  increased  beyond  the  autopilot’s  45°  limit,  and  (at  1554:24.1)  the 
autopilot  disconnect  warning  began  to  sound.  One  second  later,  the  stick  shaker  activated.  The 
sudden  disengagement  of  the  autopilot  (at  1554:24.125)  greatly  accelerated  the  left  rolling 
moment  that  had  been  developing,  suddenly  putting  the  airplane  in  an  unusual  attitude.  Although 
the  pilots  were  likely  surprised  by  the  upset  event,  interpretation  of  the  FDR  data  indicated  that 
the  pilots  responded  with  control  wheel  inputs  to  counter  the  left  roll  within  1  second  of  the 
autopilot  disengagement  and  continued  to  apply  control  inputs  in  an  apparent  attempt  to  regain 
control  of  the  airplane  until  the  FDR  recording  ceased. 

Meteorological  Factors 

Although  Comair  flight  3272  was  operating  in  winter  weather  conditions  throughout  its 
flight  from  the  Cincinnati  area  to  Detroit,  CVR  and  weather  information  indicated  that  the 
airplane  was  operating  above  the  cloud  tops  at  its  cruise  altitude  of  21,000  feet  msl.  Further,  the 
temperatures  at  the  altitudes  flown  during  the  en  route  phase  of  the  flight  were  too  cold  to  be 
conducive  to  airframe  ice  accretion,  and  examination  of  the  FDR  data  did  not  reflect  degraded 
airplane  performance  until  later  in  the  airplane’s  descent.  Therefore,  the  Safety  Board  concludes 
that  the  airplane  was  aerodynamically  clean,  with  no  effective  ice  accreted,  when  it  began  its 
descent  to  the  Detroit  area. 

A  study  conducted  by  the  National  Center  for  Atmospheric  Research  (NCAR)  indicated 
that  there  was  strong  evidence  for  the  existence  of  icing  conditions  in  the  clouds  along  the 
accident  airplane’s  descent  path  below  1 1,000  feet  msl.  In  addition,  weather  radar  data  showed 
generally  light  precipitation  intensities  in  the  area  west  of  Detroit,  with  weather  echoes  of 
increasing  intensity  below  11,000  feet  msl  along  the  airplane’s  descent  path.  The  weather  radar 
data  indicated  that  the  highest  precipitation  intensities  likely  existed  between  4,100  feet  msl  and 
3,900  feet  msl. 


6  An  engine  torque  split  manifested  itself  during  this  application  of  power— at  1554: 17,  the  FDR  recorded 
torque  values  of  33.3  percent  and  39.3  percent  on  the  left  and  right  engines,  respectively.  The  engine  torque  split 
ranged  from  6  to  10  percent  between  1554:17  and  1554:22,  when  torque  values  (and  the  range  of  the  torque  split) 
began  to  increase  abruptly.  Simulator  test  flights  that  replicated  the  accident  scenario  demonstrated  that  the  initial 
6  to  10  percent  torque  split  did  not  have  a  large  aerodynamic  effect  on  the  airplane’s  left  roll;  however,  the  larger 
torque  split  that  occurred  later  in  the  accident  sequence  had  a  significant  aerodynamic  effect 
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The  NCAR  research  meteorologists  reported  that  the  average  liquid  water  content  (LWC) 
in  the  clouds  near  the  accident  site  likely  varied  from  0.025  to  0.4  grams  per  cubic  meter  when 
averaged  over  the  cloud  depth.  However,  according  to  an  NCAR  research  meteorologist,  droplet 
size  and  LWC  are  rarely  evenly  distributed  through  the  depth  of  a  cloud;  he  stated  that,  in  a 
typical  cloud  distribution,  the  larger  droplet  sizes  with  corresponding  lower  LWC  would  likely 
exist  near  the  cloud  bases,  whereas  smaller  droplet  sizes  with  higher  LWC  would  typically  exist 
near  the  cloud  tops.  He  stated  that  the  accident  airplane  might  have  encountered  higher  LWC 
values  (0.5-0.8  grams  per  cubic  meter)  with  smaller  droplets  (non-supercooled  large  droplets 
(SLD),  10-30  microns)  near  the  cloud  tops  and  lower  LWC  values  (0.025  to  0.4  grams  per  cubic 
meter)  with  larger  droplets  (larger  than  30  microns)  near  the  cloud  bases  (consistent  with  the 
previously  discussed  weather  radar  data).  Further,  the  NCAR  research  meteorologist  stated,  “if 
any  SLD  existed... it  would  have  been  more  likely  to  be  lower  in  the  cloud... be  mixed  with 
smaller  drops. .  .the  larger  drops  in  the  spectrum  of  those  that  may  have  existed  there  would  have 
been  in  the  200-400  micron. .  .range.” 

In  addition,  the  accident  airplane’s  descent  path  passed  through  an  area  of  relatively  low 
radar  reflectivity  during  the  4  to  5  minutes  before  the  accident.  According  to  the  NCAR  report, 
the  area  of  reduced  reflectivity  indicated  that  “the  snow-making  process  was  less  efficient  there, 
thus  allowing  a  greater  opportunity  for  liquid  cloud  to  exist.”  Postaccident  statements  obtained 
from  the  other  pilots  who  were  operating  along  the  accident  airplane’s  flightpath  (and  passed 
through  the  area  of  low  reflectivity)  near  the  time  of  the  accident  indicated  that  they  encountered 
widely  variable  conditions.  For  example,  the  pilots  of  Cactus  50  reported  moderate  rime  icing 
with  the  possibility  of  freezing  drizzle,  the  pilots  of  Northwest  Airlines  (NW)  flight  272 
encountered  moderate-to-severe  rime  icing  as  soon  as  they  leveled  off  at  4,000  feet  msl,  and  the 
pilots  of  NW  flight  483  reported  no  icing. 

Comparison  of  data  from  the  airplanes  indicates  that  the  differences  in  airframe  ice 
accretion  reported  by  the  pilots  can  be  attributed  to  slight  differences  in  timing,  altitude,  location 
(ground  track),  airspeed,  and  icing  exposure  time  (and  time  within  the  area  of  reduced  reflectivity) 
of  the  airplanes.  Based  on  weather  radar  information  and  pilot  statements,  the  Safety  Board 
concludes  that  the  weather  conditions  near  the  accident  site  were  highly  variable  and  were 
conducive  to  the  formation  of  rime  or  mixed  ice  at  various  altitudes  and  in  various  amounts,  rates, 
and  types  of  accumulation;  if  SLD  icing  conditions  were  present,  the  droplet  sizes  probably  did 
not  exceed  400  microns  and  most  likely  existed  near  4,000  feet  msl. 

Aerodynamic  Effect  of  the  Ice  Accretion 

To  help  assess  the  type,  amount,  and  effect  of  the  ice  that  might  have  been  accumulated  by 
Comair  flight  3272  during  its  descent,  the  Safety  Board  reviewed  the  available  icing  and  wind 
tunnel  research  data,  conducted  additional  airplane  performance  studies/simulations,  and 
requested  the  National  Aeronautics  and  Space  Administration’s  (NASA’s)  assistance  in 
conducting  icing  research  tunnel  (IRT)  tests  and  computational  studies.  In  addition,  the  Safety 
Board  reviewed  wind  tunnel  test  data  obtained  during  research  conducted  by  the  FAA  at  the 
University  of  Illinois  at  Urbana/Champaign  (UIUC). 
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The  Safety  Board’s  study  of  the  accident  airplane’s  aerodynamic  performance  indicated 
that  it  began  to  degrade  from  ice  accumulation7  about  4'A  to  5  minutes  before  the  autopilot 
disengaged,  as  the  airplane  descended  through  7,000  feet  msl;  the  amount  of  degradation 
increased  gradually  as  the  airplane  descended  to  4,000  feet  msl.  Based  on  this  gradual 
performance  degradation,  weather  radar  data  that  showed  light  precipitation  intensities,  pilot 
reports  of  moderate  or  less  ice  accretions,8  and  the  Safety  Board  and  NCAR  weather  studies,  it 
appeared  likely  that  Comair  flight  3272  encountered  icing  conditions  that  fell  within  the  14  CFR 
Part  25  appendix  C  envelope9  and/or  the  lower  portion  of  the  SLD  icing  range  during  its  descent 
to  4,000  feet  msl.  Thus,  the  postaccident  icing  tunnel  tests  were  performed  using  LWCs  between 
0.52  and  0.85  grams  per  cubic  meter  and  water  droplet  sizes  between  20  microns  and  270 
microns.  Total  air  temperatures  (TAT)  used  in  the  icing  tunnel  tests  ranged  between  26°  F  and 
31°  F  (-3°  C  and  -0.5°  C),10  consistent  with  the  static  air  temperature  (SAT)  values  recorded  by 
the  FDR  during  the  airplane’s  descent  from  7,000  to  4,000  feet  msl.  The  exposure  time  used  in 
the  icing  tunnel  tests  was  5  minutes;  additional  runs  were  conducted  under  some  test  conditions  to 
determine  the  effect  that  deicing  boot  activation  had  on  cleaning  the  leading  edge  and  on 
subsequent  ice  accretions. 

The  icing  tunnel  tests  did  not  result  in  thick  ice  accumulation  under  any  test  condition 
(including  SLD  droplets);  rather,  the  tests  consistently  resulted  in  a  thin  (0.25  inch  accumulation 
or  less),  rough  “sandpaper-type”  ice  coverage  over  a  large  portion  of  the  airfoil’s  leading  edge 
deicing  boot  surface  area  (and  aft  of  the  deicing  boot  on  the  lower  wing  surface  in  some  test 
conditions).  In  addition,  in  many  IRT  test  conditions,  small  (lA  inch)  ice  ridges  accreted  along  the 
leading  edge  deicing  boot  seams.  According  to  NASA  and  Safety  Board  IRT  test  observers,  the 
thin,  rough  ice  coverages  (and  ice  ridges,  where  applicable)  that  accreted  on  the  EMB-120  wing 
were  somewhat  translucent  and  were  often  difficult  to  perceive  from  the  observation  window. 
The  IRT  observers  further  noted  that  IRT  lighting  conditions  and  cloud  (spray)  type  greatly 
affected  the  conspicuity  of  the  ice  accumulation,  making  it  difficult  to  perceive  die  ice 
accumulation  during  the  icing  exposure  periods.  Scientists  at  NASA’s  Lewis  Research  Center 
described  the  IRT  ice  accretions  as  mostly  “glaze”  ice,  like  mixed  or  clear  ice  in  nature,  although 
it  looked  slightly  like  rime  ice  when  the  IRT  was  brightly  lighted  for  photographic  documentation 
of  the  ice  accretions  because  of  its  roughness.  The  Safety  Board  notes  that  it  is  possible  that  such 
an  accumulation  would  be  difficult  for  pilots  to  perceive  visually  during  flight,  particularly  in  low 
light  conditions.  This  type  of  accumulation  would  be  consistent  with  the  accident  airplane’s  CVR, 
which  did  not  record  any  crew  discussion  of  perceived  ice  accumulation  and/or  the  need  to 
activate  deicing  boots  during  the  last  5  minutes  of  the  accident  flight. 


7  Although  the  Safety  Board  considered  other  possible  sources  for  the  aerodynamic  degradation  (such  as  a 
mechanical  malfunction),  the  physical  evidence  did  not  support  a  system  or  structural  failure,  and  the  FDR  data 
indicated  a  gradual,  steadily  increasing  performance  degradation  that  was  consistent  with  degradation  observed  by 
the  Safety  Board  in  data  from  events  in  which  icing  was  a  known  factor. 

8  All  pilot  reports  indicated  moderate  or  less  ice  accretions,  except  the  pilots  of  NW  flight  272,  who 
reported  that  they  encountered  a  trace  of  rime  ice  during  the  descent,  then  encountered  moderate-to-severe  icing  at 
4,000  feet  msl  about  2  minutes  after  the  accident. 

9  The  Part  25  appendix  C  icing  envelope  specifies  the  water  drop  mean  effective  diameter,  the  LWC,  and 
the  temperatures  at  which  the  airplane  must  be  able  to  safely  operate;  aircraft  compliance  must  be  demonstrated 
through  analysis,  experimentation,  and  flight  testing.. 

10  These  TATs  are  equivalent  to  SATs  of  21°  F  (-6°  C)  to  25.5°  F  (-3°  C). 
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The  location  of  rough  ice  coverage  observed  during  the  icing  tunnel  tests  varied, 
depending  on  AOA;  at  lower  AOAs,  the  ice  accretions  extended  farther  aft  on  the  upper  wing 
surface  (to  the  aft  edge  of  the  deicing  boot  on  the  upper  wing  surface,  about  7  percent  of  the  wing 
chord  at  the  aileron  midspan),  whereas  at  higher  AOAs,  the  ice  accretions  extended  farther  aft  on 
the  lower  wing  surface.  In  some  IRT  test  conditions,  sparse  feather-type  ice  accretion  extended 
aft  of  the  deicing  boot  coverage  on  the  lower  wing  surface  (which  extends  to  about  1014  percent 
of  the  airfoil  chord  at  the  aileron  midspan)  as  far  as  30  to  35  percent  of  the  airfoil’s  chord." 

The  density  of  the  rough  ice  coverage  also  varied,  depending  on  the  exposure  time;  a 
sparse  layer  of  rough  ice  usually  accreted  on  the  entire  impingement  area  during  the  first  30 
seconds  to  1  minute  of  exposure,  and  the  layer  became  thicker  and  more  dense  as  exposure  time 
increased.  The  NASA-Lewis  and  FAA/LJIUC  tests  indicated  that  thin,  rough  ice  accretions 
located  on  the  leading  edge  and  lower  surface  of  the  airfoil  primarily  resulted  in  increases  in  drag, 
while  thin,  rough  ice  accretions  located  on  the  leading  edge  and  upper  wing  surface  had  an 
adverse  effect  on  both  lift  and  drag;  this  is  consistent  with  information  that  has  been  obtained 
during  National  Advisory  Committee  for  Aeronautics  (NACA)/NASA  icing  research  conducted 
since  the  late  1930s.  Data  from  research  conducted  in  the  1940s  and  1950s  indicate  that  an 
airfoil’s  performance  can  be  significantly  affected  by  even  a  relatively  small  amount  of  ice 
accumulated  on  the  leading  edge  area,  if  that  accumulation  has  a  rough,  sandpaper-type  surface. 

Consistent  with  these  data,  NASA’s  drag  calculations  indicated  that  the  thin,  rough  layer 
of  sandpaper-type  ice  accumulation  resulted  in  significant  drag  and  lift  degradation  on 
the  EMB-120  wing  section.  Further,  the  thin  rough  ice  accumulation  resulted  in  a  decrease  in 
stall  AOA  similar  to  that  observed  in  wind  tunnel  tests  with  3-inch  ram’s  horn  ice  shapes  on 
protected  surfaces  and  frequently  demonstrated  a  more  drastic  drop  offTbreak  at  the  stall  AOA. 
FAA/UIUC  conducted  wind  tunnel  tests  using  generic  shapes  to  represent  the  sandpaper-type 
roughness  with  ridges  placed  on  the  upper  wing  surface  at  6  percent  of  the  wing  chord  (farther  aft 
than  the  ice  ridges  observed  during  NASA’s  IRT  tests);  these  tests  further  demonstrated  that  the 
ridge  type  of  ice  accretion  resulted  in  more  adverse  aerodynamic  effect  than  the  3-inch  ram’s  hom 
ice  shapes. 

As  previously  noted,  NASA’s  IRT  tests  indicated  that  when  an  EMB-120  wing  is  exposed 
to  conditions  similar  to  those  encountered  by  Comair  flight  3272  before  the  accident,  the  airfoil 
tended  to  accrete  a  small  ice  ridge  (or  ridges)  along  the  deicing  boot  tube  segment  stitchlines. 


11  According  to  NASA-Lewis  scientists,  some  of  the  frost  accretion  observed  aft  of  the  deicing  boot  on  the 
lower  wing  surface  during  the  icing  tunnel  tests  might  have  been  an  artifact  of  the  icing  research  tunnel  (resulting 
from  the  higher  turbulence,  humidity,  and  heat  transfer  characteristics  of  the  tunnel).  However,  the  B.F.  Goodrich 
ice  impingement  study  (which  predicts  ice  accretion  impingement  limits  on  an  airfoil)  and  NASA’s  LEWICE 
computer  program  (which  predicts  the  extent  of  ice  accretion  on  the  leading  edges  of  airplane  wings  and 
impingement  limits  and  ice  thickness  for  specified  conditions  but  cannot  predict  surface  roughness  features)  also 
predicted  a  sparse,  rough  ice  accretion  aft  of  the  deicing  boot  on  the  lower  wing  surface  for  some  of  the  tested 
conditions.  However,  no  ice  accretion  aft  of  the  deicing  boot  was  noticed  during  the  natural  icing  certification 
tests.  Although  it  is  possible  that  some  of  the  drag  observed  in  the  accident  airplane’s  performance  was  the  result 
of  a  sparse,  rough  ice  accumulation  aft  of  the  deicing  boot  on  the  lower  wing  surface,  it  was  not  possible  to 
positively  determine  whether  the  accident  airplane’s  ice  accretion  extended  beyond  the  deicing  boot  coverage. 
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During  tests  conducted  at  a  TAT  of  26°  F,  a  small,  but  prominent  QA  inch)  ridge  of  ice  frequently 
appeared  on  the  forward  portion  (0.5  to  1  percent  mean  aerodynamic  chord)  of  the  leading  edge 
deicing  boot’s  upper  surface. 

The  IRT  test  results  were  used  in  NASA’s  computational  studies,  which  indicated  that 
these  pronounced  ice  ridges  tended  to  act  as  stall  strips,  creating  more  disrupted  airflow  over  the 
airfoil’s  upper  surface,  further  decreasing  the  lift  produced  by  the  airfoil,  and  resulting  in  a  lower 
stall  AOA  than  the  rough  ice  accretions  alone.  NASA’s  computational  study  data  indicated  that  a 
thin,  rough  ice  accretion  with  a  small,  prominent  ice  ridge  can  result  in  a  lower  stall  AOA  and  a 
more  dramatic  drop  off/break  than  the  3-inch  ram’s  horn  ice  shape  commonly  used  during  initial 
icing  certification  testing. 

The  accident  airplane’s  performance  displayed  evidence  of  adverse  effects  on  both  lift  and 
drag  during  the  airplane’s  descent  to  4,000  feet  msl.  The  degradation  exhibited  by  the  accident 
airplane  was  consistent  with  a  combination  of  thin,  rough  ice  accumulation  on  the  impingement 
area  (including  both  upper  and  lower  wing  leading  edge  surfaces),  with  possible  ice  ridge 
accumulation.  Thus,  based  on  its  evaluation  of  the  weather,  radar,  drag  information,  CVR, 
existing  icing  research  data,  and  postaccident  icing  and  wind  tunnel  test  information,  the  Safety 
Board  concludes  that  it  is  likely  that  Comair  flight  3272  gradually  accumulated  a  thin,  rough 
glaze/mixed  ice  coverage  on  the  leading  edge  deicing  boot  surfaces,  possibly  with  ice  ridge 
formation  on  the  leading  edge  upper  surface,  as  the  airplane  descended  from  7,000  feet  msl  to 
4,000  feet  msl  in  icing  conditions;  further,  this  type  of  ice  accretion  might  have  been  imperceptible 
to  the  pilots. 

The  Safety  Board  notes  thatFAA  Order  7110.10L,  “Flight  Services,”  contains  a  definition 
of  “trace”  ice  accumulations,  that  states,  in  part,  “A  trace  of  ice  is  when  ice  becomes 
perceptible.... It  is  not  hazardous  even  though  deicing/anti-icing  equipment  is  not  utilized  unless 
encountered  for  an  extended  period  of  time  [over  1  hour].”  Information  obtained  during  this 
investigation,  which  echoed  the  results  of  research  conducted  in  the  1930s  and  1940s,  indicated 
that  thin,  rough  amounts  of  ice,  even  in  trace  amounts  can  result  in  hazardous  flight  conditions. 
The  Safety  Board  concludes  that  the  suggestion  in  current  FAA  publications  that  “trace”  icing  is 
“not  hazardous”  can  mislead  pilots  and  operators  about  the  adverse  effects  of  thin,  rough  ice 
accretions.  Therefore,  the  Safety  Board  believes  that  the  FAA  should  amend  the  definition  of 
trace  ice  contained  in  FAA  Order  7110.10L,  “Flight  Services,”  (and  in  other  FAA  documents  as 
applicable)  so  that  it  does  not  indicate  that  trace  icing  is  not  hazardous. 

The  Safety  Board  notes  that  in  some  icing  exposure  scenarios,  pilots  could  become  aware 
of  the  performance  degradation  without  observing  a  significant  accumulation  of  ice  on  the 
airplane  by  observing  other  cues,  such  as  a  decrease  in  airspeed,  excessive  pitch  trim  usage,  a 
higher-than-normal  amount  of  engine  power  needed  to  maintain  a  stabilized  condition,  and/or 
anomalous  rates  of  climb  or  descent.  However,  the  Safety  Board  concludes  that  because  the 
pilots  of  Comair  flight  3272  were  operating  the  airplane  with  the  autopilot  engaged  during  a  series 
of  descents,  right  and  left  turns,  power  adjustments,  and  airspeed  reductions,  they  might  not  have 
perceived  the  airplane’s  gradually  deteriorating  performance. 
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Further,  although  it  is  possible  (based  on  the  icing  reported  by  the  pilots  of  NW  flight  272 
and  the  NCAR  scientist’s  estimation  of  the  likely  droplet  size  distribution  in  the  clouds)  that  the 
accident  flight  encountered  SLD  icing12  as  it  reached  4,000  feet  msl,  the  airplane  was  only  at  that 
altitude  for  about  25  seconds  before  the  upset  occurred;  during  most  of  that  25  seconds,  the  FDR 
data  showed  that  the  autopilot  was  countering  the  increasing  left  roll  tendency  and  a  sideslip 
condition  was  developing.  However,  even  if  the  accident  flight  had  accumulated  ice  at  the  rapid 
rate  reported  by  the  pilots  of  NW  flight  272  (about  Vi  inch  per  minute),  the  accident  flight  could 
not  have  accumulated  a  large  amount  of  ice  during  the  brief  period  of  time  it  spent  at  4,000  feet 
before  the  autopilot  disengaged  and  the  loss  of  control  occurred.  Further,  icing  of  the  magnitude 
described  by  the  pilots  of  NW  flight  272  would  have  produced  strong  visual  cues,  and  it  is  likely 
that  the  pilots  would  have  commented  on  such  a  rapid  accumulation,  had  it  occurred.  The 
accident  airplane’s  CVR  did  not  record  any  flightcrew  comments  about  ice  accumulation  or  the 
need  to  activate  the  leading  edge  deicing  boots  during  the  last  5  minutes  of  the  accident  flight;  this 
is  consistent  with  an  ice  accumulation  that  was  either  not  observed  by  the  pilots  or  that  was 
observed  but  considered  to  be  unremarkable. 

Use  of  Deice/Anti-ice  Equipment 

The  Safety  Board  attempted  to  determine  whether  the  airplane’s  ice  protection  systems 
were  operated  during  the  accident  airplane’s  descent  and  approach  to  DTW.  CVR  information 
showed  that  when  the  pilots  performed  the  descent  checklist  at  1547,  they  confirmed  that  the 
airplane’s  “standard  seven”  anti-ice  systems  were  activated  and  activated  the  windshield  heat  and 
the  propeller  deice  system.13  This  was  consistent  with  guidance  contained  in  Comair’s  EMB-120 
Flight  Standards  Manual  (FSM),  which  stated  that  anti-ice  systems  should  be  activated  “before 
flying  into  known  icing  conditions”  to  prevent  ice  accumulation  on  the  affected  surfaces. 
Comair’s  EMB-120  FSM  defined  icing  conditions  as  existing  “when  the  OAT  [outside  air 
temperature]  is  +5°  C  or  below  and  visible  moisture  in  any  form  is  present  (such  as  clouds,  rain, 
snow,  sleet,  ice  crystals,  or  fog  with  visibility  of  one  mile  or  less).” 

For  years,  airplane  manufacturers  have  incorporated  leading  edge  deicing  boots  in  the 
design  of  airplanes  that  are  to  be  certificated  for  operation  in  icing  conditions;  the  purpose  of 
deicing  boots  is  to  shed  the  ice  that  accumulates  on  protected  surfaces  of  the  airframe.  Over  the 
years,  leading  edge  deicing  boots  have  demonstrated  their  effectiveness  to  operators  and  pilots  by 
keeping  the  wing  and  tail  leading  edges  relatively  clear  of  aerodynamically  degrading  ice 
accumulations,  to  the  point  that  operators  and  pilots  have  become  confident  that  the  airplanes  can 
be  flown  safely  in  icing  conditions  as  long  as  the  airplane’s  deicing  boots  are  operated  (and 
functioning)  properly.  However,  based  on  problems  with  earlier  deicing  boot  designs  (which  used 
larger  tubes  and  lower  pressures,  resulting  in  slower  inflation/deflation  rates),  manufacturers, 
operators,  and  pilots  developed  the  belief  that  premature  activation  of  the  leading  edge  deicing 
boots  could  (as  cautioned  in  Comair’s  EMB-120  FSM)  “result  in  the  ice  forming  the  shape  of  an 

12  Results  from  the  SLD  icing  tanker  tests  suggest  that  the  visual  cues  for  SLD  ice  accumulations 
(unusually  extensive  ice  accreted  on  the  airframe  in  areas  not  normally  observed  to  collect  ice,  accumulation  of  ice 
on  the  upper  surface  of  the  wing  aft  of  the  protected  area,  and  on  the  propeller  spinner  farther  aft  than  normally 
observed)  would  have  been  very  apparent  to  the  pilots  and  might  have  resulted  in  a  comment. 

13  Although  Embraer’s  nomenclature  identifies  the  propeller  ice  protection  mechanism  as  a  deicing 
system,  it  functions  as  an  anti-icing  system  because  it  is  activated  before  ice  accumulates  on  the  airframe. 
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inflated  de-ice  boot,  making  fUrther  attempts  to  deice  in  flight  impossible  [ice  bridging]  ”  Thus,  at 
the  time  of  the  accident,  Comair’s  (and  most  other  EMB-120  operators’)  guidance  indicated  that 
pilots  should  delay  activation  of  the  leading  edge  deicing  boots  until  they  observed  Vi  inch  to  Vi 
inch  ice  accumulation,  despite  Embraer’s  FAA  and  Centro  Tecnico  Aeroespadal  of  Brazil  (CTA) 
approved  EMB-120  Airplane  Flight  Manual  (AFM)  revision  43,  which  indicated  that  pilots  should 
activate  the  leading  edge  deicing  boots  at  the  first  sign  of  ice  accumulation. 

The  pilots’  activation  of  the  propeller  and  windshield  ice  protection  systems  when  the 
airplane  entered  the  clouds  would  indicate  that  they  were  aware  that  the  airplane  was  operating  in 
icing  conditions.  If  they  had  activated  the  leading  edge  deicing  boots,  at  least  some  of  the 
airplane’s  degraded  performance  would  have  been  restored.  However,  even  if  the  pilots  observed 
any  of  the  thin,  rough  ice  accretion  that  likely  existed  before  the  loss  of  control,  they  probably 
would  not  have  activated  the  deicing  boots  because  Comair’s  guidance  to  its  pilots  advised 
against  activating  the  deicing  boots  until  they  observed  a  thicker  ice  accumulation.  Therefore, 
based  on  CVR  information  and  on  the  steady  degradation  of  airplane  performance  that  was  clearly 
uninterrupted  by  leading  edge  deicing  boot  activation,  the  Safety  Board  concludes  that,  consistent 
with  Comair’s  procedures  regarding  ice  protection  systems,  the  pilots  did  not  activate  the  leading 
edge  deicing  boots  during  their  descent  and  approach  to  the  Detroit  area,  likely  because  they  did 
not  perceive  that  the  airplane  was  accreting  significant  (if  any)  structural  ice. 

During  the  postaccident  (November  1997)  Airplane  Deicing  Boot  Ice  Bridging  Workshop, 
information  regarding  recent  icing  tunnel  and  flight  test  research  into  the  ice  bridging  phenomenon 
was  disseminated  and  discussed  among  industry  personnel.  The  recent  research  revealed  that 
modem  turbine-powered  airplanes,  with  their  high-pressure,  segmented  pneumatic  deicing  boots, 
are  not  at  risk  for  ice  bridging.14  However,  in  April  1996  when  Embraer  issued  (FAA-  and  CTA- 
approved)  revision  43  to  the  EMB-120  AFM,  the  procedure  it  recommended — activation  of  the 
leading  edge  deicing  boots  at  the  first  sign  of  ice  accretion — was  not  consistent  with  traditional 
industry  concerns  about  ice  bridging.  According  to  the  FAA’s  EMB-120  Aircraft  Certification 
Program  Manager,  when  the  EMB-120  AFM  revision  was  proposed  by  Embraer  in  late  1995,  the 
deicing  boot  procedural  change  was  very  controversial  and  generated  numerous  discussions 
among  FAA  and  industry  personnel.  The  FAA’s  EMB-120  Aircraft  Certification  Program 
Manager  stated  that  the  aircraft  evaluation  group  (AEG)  personnel  involved  in  the  discussions 
about  the  six  EMB-120  icing-related  events,  the  EMB-120  in-flight  icing  tanker  tests,  and  the 
deicing  boot  procedural  change  were  initially  resistant  to  the  deicing  boot  procedural  change 
because  of  the  perceived  potential  for  ice  bridging. 

The  Safety  Board  notes  that  during  the  winter  of  1995/1996,  senior  Comair  personnel 
(and  representatives  from  other  EMB-120  operators)  were  involved  in  numerous  meetings  and 
discussions  regarding  the  six  preaccident  icing-related  events  and  that  they  subsequently  received 
Embraer’s  Operational  Bulletin  (OB)  120-002/96  and  revision  43  to  the  EMB-120  AFM,  with  its 
controversial  deicing  boot  procedural  change.  Although  these  discussions  and  documents 
apparently  heightened  senior  Comair  personnel’s  awareness  and  concern  about  EMB-120 
operations  in  icing  conditions  (as  evidenced  by  the  December  1995  interoffice  memo,  entitled 


14  It  is  important  to  note  that  ice  bridging  may  still  be  a  potential  hazard  for  airplanes  with  older 
technology  deicing  boots  that  have  slower  inflation/deflation  rates. 
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“Winter  Operating  Tips,”  and  the  October  1996  flight  standards  bulletin  (FSB)  96-04,  entitled 
“Winter  Flying  Tips”),  until  the  (postaccident)  ice  bridging  workshop,  there  was  insufficient 
information  available  to  allay  the  company’s  concerns  regarding  the  perceived  hazards  of  ice 
bridging.  Because  Comair  management  personnel  were  still  concerned  that  ice  bridging  was  a 
problem  for  modem  turbopropeller-driven  airplanes,  at  the  time  of  the  accident,  the  company’s 
deicing  boot  activation  procedures  had  not  been  revised  in  accordance  with  AFM  revision  43. 
The  Safety  Board  recognizes  the  concerns  regarding  ice  bridging  that  Comair  had  at  the  time  of 
the  accident  (before  the  ice  bridging  workshop)  and  notes  that  the  FAA  had  not  mandated 
incorporation  of  the  procedural  revision  or  engaged  in  discussions  with  EMB-120  operators/pilots 
regarding  the  merit  of  the  procedural  change.  Apparently,  Comair  was  not  the  only  EMB-120 
operator  with  concerns  regarding  the  deicing  boot  procedural  change  because  the  air  carriers’ 
records  indicated  that  at  the  time  of  the  accident,  only  two  of  seven  U.S.-based  EMB-120 
operators  had  incorporated  the  revision  into  its  procedural  guidance.  However,  the  Board  is 
concerned  that  Comair’s  EMB-120  pilots  did  not  have  access  to  the  most  current  information 
regarding  operating  the  EMB-120  in  icing  conditions. 

The  Safety  Board  concludes  that  had  the  pilots  of  Comair  flight  3272  been  aware  of  the 
specific  airspeed,  configuration,  and  icing  circumstances  of  the  six  previous  EMB-120  icing- 
related  events  and  of  the  information  contained  in  OB  120-002/96  and  revision  43  to  the 
EMB-120  AFM,  it  is  possible  that  they  would  have  operated  the  airplane  more  conservatively 
with  regard  to  airspeed  and  flap  configuration  or  activated  the  deicing  boots  when  they  knew  they 
were  in  icing  conditions.  Therefore,  the  Safety  Board  believes  that  the  FAA  should  require 
principal  operations  inspectors  (POIs)  to  discuss  the  information  contained  in  AFM  revisions 
and/or  manufacturers’  OBs  with  affected  air  carrier  operators  and,  if  the  POI  determines  that  the 
information  contained  in  those  publications  is  important  information  for  flight  operations,  to 
encourage  the  affected  air  carrier  operators  to  share  that  information  with  the  pilots  who  are 
operating  those  airplanes. 

According  to  EMB-120  pilots  from  Comair  and  the  Air  Line  Pilots  Association  (ALP A), 
their  discussions  with  other  EMB-120  flightcrews  indicate  that  the  procedural  change  is  still  a 
controversial  issue,  despite  the  information  revealed  during  this  accident  investigation  and  at  the 
November  1997  Airplane  Deicing  Boot  Ice  Bridging  Workshop.  This  illustrates  how  thoroughly 
ingrained  the  ice  bridging  concept  was  in  pilots  and  operators  and  the  importance  of  an  ice 
bridging  pilot  education  program.  Therefore,  a  thin,  yet  performance-decreasing  type  of  ice 
(similar  to  that  likely  accumulated  by  Comair  flight  3272)  can  present  a  more  hazardous  situation 
than  a  3-inch  ram’s  horn  ice  accumulation  because  it  would  not  necessarily  prompt  the  activation 
of  the  boots.  Based  on  this  information,  the  Safety  Board  concludes  that  the  current  operating 
procedures  recommending  that  pilots  wait  until  ice  accumulates  to  an  observable  thickness  before 
activating  leading  edge  deicing  boots  results  in  unnecessary  exposure  to  a  significant  risk  for 
turbopropeller-driven  airplane  flight  operations.  Based  primarily  on  concerns  about  ice  bridging, 
pilots  continue  to  use  procedures  and  practices  that  increase  the  likelihood  of  (potentially 
hazardous)  degraded  airplane  performance  resulting  from  small  amounts  of  rough  ice  accumulated 
on  the  leading  edges. 

The  Safety  Board  is  aware  that  the  FAA,  NASA,  and  ALPA  plan  to  organize  an  industry¬ 
wide  air  carrier  pilot  training  campaign  to  increase  pilots’  understanding  of  the  ice  bridging 
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phenomenon  and  safe  operation  of  deicing  boots.  Unfortunately,  according  to  NASA  personnel, 
the  training  program  has  not  yet  begun  because  the  FAA  is  still  developing  its  position  based  on 
information  from  the  Ice  Bridging  Workshop.  The  Safety  Board  appreciates  the  FAA’s  intention 
to  initiate  the  development  of  ice  bridging  training  and  its  desire  to  ensure  that  the  training  is  as 
thorough  and  accurate  as  possible;  however,  the  Board  is  concerned  that  the  planned  training  is 
being  delayed.  Further,  the  planned  training  primarily  targets  air  carrier  pilots,  and  the  Board 
considers  it  important  that  the  information  be  disseminated  to  all  affected  pilots/operators.  The 
Safety  Board  is  concerned  that  if  nonair  carrier  pilots  and  operators  do  not  receive  the  training, 
they  may  operate  turbopropeller-driven  airplanes  in  icing  conditions  using  deicing  boot 
procedures  that  result  in  less  safe  flight  operations.  A  training  program  that  reaches  only  a  limited 
part  of  the  pilot  population  may  not  be  sufficient  to  eliminate  the  pervasive  beliefs  regarding  the 
potential  for  ice  bridging  in  turbopropeller-driven  airplanes. 

Therefore,  the  Safety  Board  believes  that  the  FAA  should  (with  NASA  and  other 
interested  aviation  organizations)  organize  and  implement  an  industry-wide  training  effort  to 
educate  manufacturers,  operators,  and  pilots  of  air  carrier  and  general  aviation  turbopropeller- 
driven  airplanes  regarding  the  hazards  of  thin,  possibly  imperceptible,  rough  ice  accumulations, 
the  importance  of  activating  the  leading  edge  deicing  boots  as  soon  as  the  airplane  enters  icing 
conditions  (for  those  airplanes  in  which  ice  bridging  is  not  a  concern),  and  die  importance  of 
maintaining  minimum  airspeeds  in  icing  conditions.  The  Safety  Board  encourages  the  FAA  and 
NASA  to  expedite  this  training  effort.  Further,  because  ice  bridging  is  not  a  concern  in  modem 
turbopropeller-driven  airplanes  and  because  thin  amounts  of  rough  ice  can  be  extremely 
hazardous,  the  Safety  Board  believes  that  the  FAA  should  require  manufacturers  and  operators  of 
modem  turbopropeller-driven  airplanes  in  which  ice  bridging  is  not  a  concern  to  review  and  revise 
the  guidance  contained  in  their  manuals  and  training  programs  to  include  updated  icing 
information  and  to  emphasize  that  leading  edge  deicing  boots  should  be  activated  as  soon  as  the 
airplane  enters  icing  conditions. 

It  is  important  to  note  that  although  leading  edge  deicing  boots  are  useful  in  minimizing 
the  adverse  affects  of  ice  accumulation  on  an  airplane’s  protected  surfaces,  activation  of  deicing 
boots  does  not  result  in  a  completely  clean  boot  surface;  some  residual  ice  remains  on  the  deicing 
boot  after  it  cycles,  and  intercycle  ice  accumulates  between  deicing  boot  cycles  (on  the  EMB-120, 
during  the  54-second  or  174-second  intervals,  depending  on  the  mode  of  boot  operation 
selected).  Icing  tunnel  tests  indicate  that  when  the  deicing  boots  are  activated  early,  the  initial 
deicing  boot  cycle  leaves  a  higher  percentage  of  residual  ice  than  it  would  with  delayed  deicing 
boot  activation.  However,  when  the  deicing  boots  remained  operating  during  the  remainder  of 
the  ice  encounter,  subsequent  deicing  boot  cycles  resulted  in  a  wing  leading  edge  about  as  clean 
as  would  occur  with  delayed  boot  activation. 

The  FAA/UIUC  wind  tunnel  tests  revealed  that  even  a  thin,  sparse  (5  percent  to 
10  percent  density  ice  coverage)  amount  of  rough  ice  accumulation  over  the  leading  edge  deicing 
boot  coverage  area  resulted  in  significant  aerodynamic  degradation.  This  information  raises 
questions  about  the  effectiveness  of  leading  edge  deicing  boots  when  dealing  with  this  type  of  ice 
accumulation,  especially  considering  a  B.F.  Goodrich  estimation  that  a  good,  effective  deicing 
boot  shed  leaves  about  20  percent  of  the  accumulated  ice  on  the  boots.  The  sparse  ice  coverage 
observed  during  the  first  30  to  60  seconds  of  exposure  time  in  some  of  NASA’s  icing  tunnel 
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test  conditions  (and  which  could  occur  between  deicing  boot  cycles)  was  estimated  by  observers 
to  be  about  10  percent.  This  combined  research  indicates  that  it  is  possible  for  a  hazardous 
situation  to  occur  even  if  pilots  operate  the  deicing  boots  early  and  throughout  the  icing 
encounter.  The  Westair  flight  7233  incident,  in  which  uncommanded  roll  and  pitch  excursions 
occurred  despite  the  fact  that  the  pilots  stated  that  they  had  activated  the  leading  edge  deicing 
boots  and  selected  the  heavy  boot  operation  mode,15  may  be  an  example  of  such  a  hazardous 
situation. 

In  addition,  a  hazardous  situation  may  develop  even  if  deicing  boots  are  operated 
throughout  an  icing  encounter  as  a  result  of  ice  accretions  on  an  airplane’s  unprotected  surfaces, 
such  as  aft  of  the  deicing  boots.  The  B.F.  Goodrich  impingement  study,  NASA’s  LEWICE 
calculations,  and  NASA  IRT  tests  indicated  that  a  light  accretion  may  occur  on  the  unprotected 
lower  wing  surfaces  aft  of  the  deicing  boot  on  the  EMB-120.  However,  Embraer  representatives 
stated  that  such  an  ice  accretion  would  result  in  only  a  trace  of  ice  accumulating  aft  of  the  deicing 
boots  and  would  have  a  minimal  aerodynamic  penalty  in  drag  only.  Although  there  was  no 
evidence  of  ice  accretion  aft  of  the  deicing  boot  during  the  EMB-120  certification  natural  icing 
tests  and  it  was  not  possible  to  determine  whether  the  accident  airplane’s  ice  accretion  extended 
aft  of  the  deicing  boot  coverage,  it  is  possible  that  ice  accretion  on  the  unprotected  surface  aft  of 
the  deicing  boot  could  exacerbate  a  potentially  hazardous  icing  situation. 

Based  on  icing  and  wind  tunnel  research  and  information  from  the  Westair  incident,  the 
Safety  Board  concludes  that  it  is  possible  that  ice  accretion  on  unprotected  surfaces  and  intercycle 
ice  accretions  on  protected  surfaces  can  significantly  and  adversely  affect  the  aerodynamic 
performance  of  an  airplane  even  when  leading  edge  deicing  boots  are  activated  and  operating 
normally.  Thus,  pilots  can  minimize  (but  not  always  prevent)  the  adverse  effects  of  ice 
accumulation  on  the  airplane’s  leading  edges  by  activating  the  leading  edge  deicing  boots  at  the 
first  sign  of  ice  accretion.  It  is  not  clear  what  effect  residual  ice/ice  accretions  on  unprotected 
nonleading  edge  airframe  surfaces  have  on  flight  handling  characteristics.  Because  not  enough  is 
known  or  understood  about  icing  in  general,  and  especially  about  the  effects  of  intercycle  and 
residual  ice,  the  Safety  Board  believes  that  the  FAA  should  (with  NASA  and  other  interested 
aviation  organizations)  conduct  additional  research  to  identify  realistic  ice  accumulations,  to 
include  intercycle  and  residual  ice  accumulations  and  ice  accumulations  on  unprotected  surfaces 
aft  of  the  deicing  boots,  and  to  determine  the  effects  and  criticality  of  such  ice  accumulations; 
further,  the  information  developed  through  such  research  should  be  incorporated  into  aircraft 
certification  requirements  and  pilot  training  programs  at  all  levels. 

The  Safety  Board  considers  it  likely  that  future  ice  detection/protection  systems  will 
decrease  the  hazards  associated  with  icing  by  incorporating  ice  detection  and  protection 
(automatic  activation  of  deicing  boots  or  anti-icing  systems)  for  individual  surfaces,  including  the 
horizontal  stabilizers,  of  all  airplanes  certificated  for  flight  in  icing  conditions.  However,  because 
ice  accretions  and  their  effects  are  not  yet  fully  understood,  the  Safety  Board  concludes  that 


15  According  to  the  pilots  of  Westair  flight  7233,  they  were  aware  that  they  were  operating  in  “icing 
conditions;”  they  stated  that  they  observed  ice  accumulating  on  the  airplane  and  had  activated  the  leading  edge 
deicing  boots  when  the  airplane  entered  the  clouds  during  their  departure. 
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current  ice  detection/protection  requirements  and  application  of  technology  (particularly  deice 
boots)  may  not  provide  adequate  protection  for  a  variety  of  ice  accumulation  scenarios  (tailplane, 
SLD,  thin,  rough  ice  accumulations,  etc.).  Therefore,  the  Safety  Board  believes  that  the  FAA 
should  actively  pursue  research  with  airframe  manufacturers  and  other  industry  personnel  to 
develop  effective  ice  detection/protection  systems  that  will  keep  critical  airplane  surfaces  free  of 
ice;  then,  require  their  installation  on  newly  manufactured  and  in-service  airplanes  certificated  for 
flight  in  icing  conditions. 


Comair’s  Airspeed  Guidance 

During  postaccident  interviews,  some  of  Comair’s  pilot  training  personnel  indicated  that 
the  company’s  EMB-120  pilot  training  emphasized  the  160-knot  minimum  airspeed  for  operating 
in  icing  conditions,  and  Comair’s  EMB-120  Program  Manager  told  Safety  Board  investigators 
that  170  knots  is  the  only  airspeed  the  company  supports  for  operating  with  the  landing  gear  and 
flaps  retracted.  Although  the  Safety  Board’s  review  of  the  airspeed  guidance  contained  in 
Comair’s  EMB-120  FSM  revealed  that  it  did  not  contain  specific  minimum  maneuvering  airspeeds 
for  flight  in  icing  conditions  and  for  various  airplane  configurations,  it  did  contain  general  airspeed 
information  in  descriptions  of  normal  and  non-normal  procedures  and  maneuvers.  For  example, 
the  technique  outlined  in  Comair’s  FSM  for  an  instrument  landing  system  (DLS)  approach 
associated  the  base  leg  vector  position  (which  was  the  accident  airplane’s  approximate  position  on 
the  approach  before  the  upset,  albeit  still  about  20  miles  from  the  destination  airport)  with  170 
knots  and  the  flaps  15  configuration.  Additional  guidance  for  the  ILS  approach  procedure 
associated  150  knots  airspeed  with  the  selection  of  25°  of  flaps.  (This  guidance  did  not  constitute 
minimum  airspeed  guidance,  but  it  did  represent  how  Comair  intended  the  airplane  to  be  flown 
and  configured  on  an  ILS  approach.) 

Comair’s  EMB-120  airspeed  reference  cards  (readily  available  and  used  by  the  flightcrew 
in  the  cockpit)  addressed  a  reference  airspeed  at  an  airplane  gross  weight  of  24,000  pounds  with 
gear  and  flaps  retracted  (Vref0)  of  147  knots,  and  a  final  segment  airspeed  (Vf3)16  of  143  knots 
(airspeeds  varied,  depending  on  the  airplane’s  gross  landing  weight  and  temperatures).  Comair’s 
EMB-120  FSM  addressed  Vref0  and  V&  airspeeds  consistent  with  the  cockpit  airspeed  reference 
cards.  The  FSM  also  contained  guidance  for  a  no-flaps  approach  and  landing  (a  non-normal 
procedure)  that  specified  a  minimum  airspeed  of  160  knots  while  maneuvering  on  the  approach, 
with  a  slight  airspeed  reduction  (the  amount  varying  with  the  weight  of  the  airplane)  once 
established  on  final  approach.  Further,  the  flap  control  fault  (a  non-normal  procedure)  checklist 
procedure  advised  pilots  to  add  35  knots  to  the  reference  airspeed  for  45°  of  flaps  for  the  zero 
flaps  configuration,  resulting  in  airspeeds  between  140  and  150  knots  (again  depending  on  the 
airplane’s  gross  weight).  The  published  stall  airspeed  for  the  EMB-120  at  24,000  pounds  gross 
weight  with  landing  gear  and  flaps  retracted  was  1 14  knots. 

During  the  13  months  before  the  accident,  Comair  had  issued  an  interoffice  memorandum 
and  an  FSB  that  contained  guidance  advising  EMB-120  pilots  to  maintain  higher  airspeeds  than 


16  V6  is  the  target  airspeed  for  flap  retraction  after  takeoff  or  during  go-around. 


14 


normal  when  operating  in  icing  conditions.  The  Comair  interoffice  memo,  issued  on  December  8, 
1995,  advised  pilots  not  to  operate  the  EMB-120  at  less  than  160  knots  in  icing  conditions  and  to 
use  170  knots  for  holding  in  icing  conditions.  According  to  Comair,  this  memo  was  distributed  to 
all  EMB-120  pilots  through  their  company  mailboxes  and  a  30-day  pilot-read  binder  but  was  not 
incorporated  into  an  FSB  or  a  revision  to  the  Comair  EMB-120  FSM.  The  FSB,  issued  on 
October  18,  1996  (to  be  inserted  at  the  back  of  the  FSM),  advised  pilots  to  maintain  a  minimum 
airspeed  of  170  knots  when  climbing  on  autopilot  or  holding  in  icing  conditions,  with  no  mention 
of  a  minimum  airspeed  for  non-climbing/non-holding  icing  operations.  Comair’s  October  1996 
FSB  did  not  support  or  repeat  the  interoffice  memo’s  blanket  160-knot  minimum  airspeed  for 
operating  an  EMB-120  in  icing  conditions.  The  Safety  Board  notes  that  the  language  used,  the 
different  airspeeds  and  criteria  contained  in  the  guidance,  Comair’s  methods  of  distribution,  and 
the  company’s  failure  to  incorporate  the  guidance  as  a  formal,  permanent  revision  to  the  FSM 
might  have  caused  pilots  to  be  uncertain  of  the  appropriate  airspeeds  for  their  circumstances. 

Additional  preaccident  airspeed  guidance  was  contained  on  the  same  page  as  revision  43 
to  Embraer’s  EMB-120  AFM  (issued  in  April  1996),  which  stated  that  the  manufacturer’s 
recommended  minimum  airspeed  for  the  EMB-120  in  icing  conditions  with  landing  gear  and  flaps 
retracted  was  160  knots.  However,  at  the  time  of  the  accident,  Comair  had  not  incorporated  the 
AFM  revision  43  information  into  its  EMB-120  FSM.  Further,  Comair  had  not  incorporated 
long-standing  AFM  information  into  its  FAA-approved  EMB-120  FSM;  specifically,  Comair’s 
FSM  did  not  contain  the  note  advising  pilots  to  increase  their  approach  airspeeds  by  5  to  10  knots 
in  icing  conditions.  (The  Safety  Board  notes  that  this  guidance  had  been  included  in  Embraer’s 
EMB-120  AFM  at  least  since  August  1991,  and  Comair’s  FAA  POI  had  not  required  the 
company  to  incorporate  the  icing-related  airspeed  guidance  into  its  FSM.)  Because  Comair’s 
pilots  used  the  company’s  Operations  Manual  and  FSM  as  their  primary  sources  of  procedural 
guidance  (rather  than  the  EMB-120  AFM),  it  is  likely  that  many  Comair  pilots  were  not  aware 
that  Embraer  considered  160  knots  to  be  the  minimum  airspeed  for  operating  the  EMB-120  in 
icing  conditions.  This  is  supported  by  the  variations  in  the  responses  provided  during 
postaccident  interviews  by  the  16  Comair  EMB-120  pilots  (including  line  pilots,  flight  instructors, 
and  line  check  airmen)  when  they  were  asked  about  the  minimum  airspeed  for  operating  the 
EMB-120  without  flaps  extended  in  icing  conditions. 

Several  of  the  pilots  interviewed  stated  that  they  would  not  have  been  comfortable 
operating  an  EMB-120  in  icing  conditions  at  an  airspeed  of  150  knots  without  flaps  extended, 
citing  160  knots  or  170  knots  as  more  acceptable  airspeeds,  based  on  previous  bulletins  and 
memos.17  Other  pilots  indicated  that  there  was  no  operational  requirement  to  maintain  a  higher 
airspeed  in  icing  conditions  but  cited  a  note  in  Comair’s  FSM  that  advised  pilots  to  increase 
approach  airspeeds  by  5  to  10  knots  when  operating  in  icing  conditions.  However,  three  Comair 
EMB-120  pilots  made  no  special  reference  to  icing  conditions  and  told  investigators  that  the 
minimum  operating  airspeed  for  the  EMB-120  flaps  up  was  below  150  knots.  One  Comair  EMB- 
120  captain  stated  that  he  considered  the  absolute  minimum  airspeed  for  operating  the  airplane 


17  Although  many  of  Comair’s  line  pilots,  flight  instructors,  and  line  check  airmen  appeared  uncertain  of 
the  minimum  airspeed  for  operating  an  EMB-120  in  icing  conditions  without  landing  gear  or  flaps  extended,  most 
of  the  pilots  interviewed  were  aware  that  Comair’s  FSB  96-04  stated  that  the  minimum  airspeed  for  holding  in 
icing  conditions  was  170  knots. 
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without  flaps  [in  nonicing  conditions]  to  be  the  Vfe  airspeed;  a  Comair  EMB-120  flight  instructor 
cited  a  minimum  EMB-120  maneuvering  airspeed  without  flaps  of  140  knots;  and  an  EMB-120 
line  check  airman  stated  that  “the  airplane  should  fly  safely  at  150  knots  clean,  but  this  is  not  a 
practice  [we]  advocate.... Vf3  (141  knots  to  147  knots),  those  are  the  minimum  clean  speeds.” 

Thus,  although  Comair’s  pilot  training  personnel  indicated  that  the  company’s  EMB-120 
pilot  training  emphasized  the  160-knot  minimum  airspeed  for  operating  in  icing  conditions,  the 
varied  responses  received  from  EMB-120  pilots  during  postaccident  interviews  indicate  that  the 
guidance  provided  was  not  consistently  understood  by  Comair’s  pilots.  Based  on  the 
inconsistencies  in  the  answers  provided  by  Comair  pilots  during  the  postaccident  interviews  and 
the  complex  and  varied  minimum  airspeed  requirements  established  by  Comair  for  both  icing  and 
nonicing  conditions,  the  Safety  Board  concludes  that  the  guidance  provided  by  Comair  in  its 
memos,  bulletins,  manuals,  and  training  program  did  not  adequately  communicate  or  emphasize 
specific  minimum  airspeeds  for  operating  the  EMB-120  in  the  flaps-up  configuration,  in  or  out  of 
icing  conditions,  and  thus  contributed  to  the  accident. 


Flightcrew’s  Airspeed/Configuration  Decisions  and  Actions 

The  Safety  Board’s  review  of  the  flightcrew’s  actions  revealed  that  there  was  no  pilot 
discussion  of  flap  usage,  stall  speeds,  recommended  minimum  airspeeds  for  icing  conditions,  ice 
accumulation  (potential  or  observed)  and  its  effects  on  the  airplane’s  performance  at  any  time 
during  the  descent  from  cruise  altitude,  nor  was  there  any  requirement  for  such  discussion.  The 
Safety  Board  considers  it  likely  that  the  pilots  would  have  commented  and/or  taken  action  (such 
as  activating  the  deicing  boots  and/or  extending  the  flaps)  if  they  had  perceived  an  unsafe 
condition,  either  as  the  result  of  a  significant  ice  accumulation  or  an  unsafe  airspeed  assignment 
for  the  airplane’s  configuration.  The  Safety  Board  acknowledges  that  increasing  the  airspeed  by 
some  increment  (Vref  +  5  knots  according  to  Comair’s  EMB-120  FSM)  when  ice  accretion  is 
observed  is  a  fairly  standard  adjustment  in  the  aviation  industry,  and  Comair’s  FSB  96-04 
specified  a  minimum  airspeed  of  170  knots  for  holding  in  icing  conditions.  However,  ATC  had 
not  issued  holding  instructions  to  the  pilots  of  Comair  flight  3272,  nor  had  ATC  indicated  that  the 
pilots  should  expect  to  receive  holding  instructions  during  the  approach  to  DTW.  Therefore,  the 
pilots  might  not  have  considered  the  170-knot  minimum  airspeed  for  holding  in  icing  conditions. 
Additionally,  as  previously  discussed,  the  pilots  might  not  have  recognized  that  they  were 
operating  in  icing  conditions  because  it  is  possible  that  the  accident  airplane  accreted  a  thin,  rough 
layer  of  glaze  ice  that  was  imperceptible  to  the  pilots.  Because  there  were  no  comments  recorded 
by  the  CVR  and  because  the  pilots  accepted  the  150-knot  airspeed  assignment  without  hesitation, 
comment,  or  reconfiguration,  the  Safety  Board  concludes  that  the  pilots  likely  did  not  recognize 
the  need  to  abide  by  special  restrictions  on  airspeeds  that  were  established  for  icing  conditions 
because  they  did  not  perceive  the  significance  (or  presence)  of  Comair  flight  3272’s  ice 
accumulation.  Further,  based  on  the  uncertainty  regarding  minimum  airspeeds  exhibited  by 
Comair  pilots  during  postaccident  interviews,  the  Safety  Board  considers  it  likely  that  under 
conditions  similar  to  those  encountered  by  the  pilots  of  Comair  flight  3272,  other  Comair  pilots 
might  have  accepted  the  same  150-knot  airspeed  assignment. 
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Although  the  Safety  Board  considers  Comair’s  airspeed  guidance  ambiguous  and  unclear 
and  acknowledges  that  the  flightcrew  might  not  have  perceived  that  the  airplane  was 
accumulating  ice  that  affected  its  flight  handling  characteristics,  the  Safety  Board  notes  that  the 
preponderance  of  the  airspeed  guidance  available  to  the  pilots  indicated  that  EMB-120  operating 
airspeeds  of  160  or  170  knots  were  standard  for  operating  without  flaps  extended  under  any 
(icing  or  nonicing)  conditions.  Although  these  airspeeds  were  not  established  minimum  airspeeds, 
they  were  the  operator’s  procedural  guidance  and  the  standards  to  which  Comair’s  pilots  were 
trained.  The  Safety  Board  considers  that  any  pilot  deviations  from  standard  procedures  during 
flight  operations  (although  not  prohibited  and  not  necessarily  unsafe)  should  be  accomplished 
thoughtfully  and  with  full  consideration  given  to  the  possible  risks  involved.  In  this  case, 
operating  at  150  knots  provided  the  pilots  with  a  reduced  safety  margin  above  the  airplane’s  stall 
speed.  The  reduction  in  stall  margin  was  especially  critical  to  the  accident  flight  because  the 
accident  airplane  had  accreted  structural  ice  during  its  descent,  which  was  having  an  adverse 
effect  on  the  airplane’s  performance  characteristics.  The  Safety  Board  notes  that  the  pilots  could 
have  increased  the  stall  margin  by  extending  15°  of  flaps  and  still  complied  with  ATC’s  airspeed 
assignment.  Further,  there  was  no  safety  or  operational  reason  to  avoid  extending  the  flaps.18 

The  Safety  Board  considers  it  critical  that  pilots  take  into  consideration  potential  adverse 
conditions,  and  make  correspondingly  conservative  decisions  where  they  are  warranted. 
Although  the  pilots  might  not  have  perceived  that  the  airplane  was  accumulating  any  ice,  their 
activation  of  the  propeller  and  windshield  heat  when  the  airplane  entered  icing  conditions  was  an 
indication  that  they  were  aware  that  they  were  entering  conditions  in  which  ice  accumulation  was 
possible. 

Based  on  Comair’s  guidance  for  an  ILS  approach  (which  Comair  uses  during  pilot 
training)  that  associates  170  knots  with  15°  of  flaps  on  the  base  leg  position,  and  additional 
airspeed  guidance  suggesting  airspeeds  of  160  to  170  knots  for  the  accident  flight’s  conditions, 
and  the  pilots’  responsibility  to  make  safe,  conservative  decisions  consistent  with  flight  in  icing 
conditions,  the  Safety  Board  concludes  that  whether  the  pilots  perceived  ice  accumulating  on  the 
airplane  or  not,  they  should  have  recognized  that  operating  in  icing  conditions  at  the  ATC- 
assigned  airspeed  of  150  knots  with  flaps  retracted  could  result  in  an  unsafe  flight  situation; 
therefore,  their  acceptance  of  the  150-knot  airspeed  assignment  in  icing  conditions  without 
extending  flaps  contributed  to  the  accident. 


18  The  Safety  Board  considered  the  possibility  that  the  flightcrew  avoided  extending  the  flaps  because  of 
guidance  to  avoid  extended  operations  in  icing  conditions  with  flaps  extended.  However,  as  previously  discussed, 
there  were  numerous  indications  that  the  flightcrew  was  not  considering  icing  as  a  significant  factor  in  the 
aiiplane’s  operation  at  the  time.  The  Safety  Board  also  considered  that  the  pilots  might  have  believed  that  they 
had  already  extended  the  flaps  to  15°  at  the  time  that  they  accepted  the  150  knot  ATC-assigned  airspeed.  However, 
at  that  time,  the  airplane  was  about  20  miles  from  the  destination  airport  and  maintaining  an  assigned  airspeed  of 
190  knots;  thus,  the  pilots  had  not  received  any  of  the  usual  (distance  and  airspeed-related)  cues  to  extend  the  flaps. 
The  Safety  Board  was  unable  to  determine  whether  the  pilots  believed  they  had  extended  the  flaps  at  any 
subsequent  time. 


17 


FAA-related  Information  Regarding  Minimum  Airspeeds 

Because  the  issue  of  safe  minimum  airspeeds  is  complex  and  critical  to  safe  flight 
operations,  in  May  1997  the  Safety  Board  issued  Safety  Recommendation  A-97-31,  which  asked 
the  FAA  to  require  air  carriers  to  reflect  FAA-approved  minimum  airspeeds  for  all  flap  settings 
and  phases  of  flight,  including  flight  in  icing  conditions,  in  their  EMB-120  operating  manuals. 
The  Safety  Board’s  recommendation  letter  referenced  the  FAA’s  notice  of  proposed  rulemaking 
(NPRM)  97-NM-46-AD,  which  established  a  minimum  safe  EMB-120  airspeed  in  icing 
conditions  of  160  knots  based  on  initial  icing  certification  flight  test  data,  stating  the  following,  in 
part: 


The  NPRM  addresses  many  of  the  safety  issues  discussed  in  this  letter.  The  Safety 
Board  is  evaluating  whether  the  proposed  160  KIAS  [knots  indicated  airspeed] 
minimum  airspeed  in  icing  conditions  is  appropriate,  and  if  the  single  speed  adequately 
addresses  the  intent  of  what  would  have  been  our  first  recommendation:  that  is,  for  the 
FAA  to  approve  for  inclusion  in  Embraer’s  EMB-120  airplane  flight  manual  minimum 
airspeeds  for  all  flap  settings  and  phases  of  flight,  including  flight  in  icing  conditions. 

The  Safety  Board  reiterated  its  concerns  on  this  subject  in  its  response  to  the  FAA’s 
NPRM  97-NM-46-AD.  Despite  the  Board’s  concerns,  the  FAA’s  final  rulemaking  for 
airworthiness  directive  (AD)  97-26-06  indicated  that  Embraer’s  initial  icing  certification  flight 
tests  demonstrated  that  a  minimum  airspeed  of  160  knots  provided  an  adequate  stall  margin, 
“provided  the  ice  protection  systems  are  properly  activated.”  Currently,  the  FAA-required 
minimum  EMB-120  airspeed  guidance  consists  of  160  knots  minimum  airspeed  for  operating  in 
icing  conditions. 

AD  97-26-06  did  not  satisfactorily  address  the  concerns  that  were  expressed  by  the  Safety 
Board  in  its  communications  regarding  Safety  Recommendation  A-97-31  and  in  its  response  to 
the  NPRM  because  the  160-knot  airspeed  was  not  scientifically  determined  and  does  not  ensure 
an  acceptable  safety  margin  for  all  foreseeable  flight  conditions  (evidence  of  Comair  flight  3272’s 
loss  of  control  were  apparent  at  156  knots — with  a  slightly  different  ice  accumulation  scenario, 
the  loss  of  control  might  have  occurred  earlier  in  the  event)  and  because  the  FAA’s  response  did 
not  adequately  address  the  complicated  issue  of  the  minimum  operating  airspeeds  (at  various  flap 
settings)  for  the  EMB-120  in  icing  conditions.  The  Safety  Board  notes  that  after  this  accident, 
because  Comair  management  did  not  believe  that  a  160-knot  airspeed  ensured  adequate  stall 
margin,  the  company  established  a  minimum  airspeed  of  170  knots  for  operating  the  EMB-120  in 
icing  conditions,  thus  increasing  the  stall  margin  in  icing  conditions  beyond  that  required  by  the 
FAA.  The  Safety  Board  is  concerned  that  absent  the  scientifically  determined  airspeed  guidance  it 
requested  from  the  FAA,  some  operators  are  arbitrarily  electing  to  increase  their  minimum  EMB- 
120  airspeeds,  whereas  others  may  continue  to  follow  current  FAA  guidance  that  provides  an 
inadequate  safety  margin.  Although  an  airspeed  greater  than  160  knots  should  be  required  to 
provide  an  adequate  safety  margin,  without  a  scientifically  based  determination  of  minimum 
operating  airspeed  in  icing  conditions,  some  operators  may  increase  the  airspeed  too  much, 
increasing  the  risk  of  tailplane  stall. 
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The  Safety  Board  is  aware  that  manufacturers  and  operators  of  many  large  air  transport 
airplanes  have  published  minimum  airspeeds  associated  with  various  flap  configurations  and 
phases  and  conditions  of  flight.  These  airspeeds  are  incorporated  into  operator’s  manuals  and 
pilot  training  programs  and  are  helpful  for  pilots  of  these  airplanes  during  flight  operations.  The 
Safety  Board  again  concludes  that  minimum  airspeed  information  for  various  flap  configurations 
and  phases  and  conditions  of  flight  would  be  helpful  to  pilots  of  all  passenger-carrying  airplanes. 
Therefore,  the  Safety  Board  believes  that  the  FAA  should  require  manufacturers  of  all  turbine- 
engine  driven  airplanes  (including  the  EMB-120)  to  provide  minimum  maneuvering  airspeed 
information  for  all  airplane  configurations,  phases,  and  conditions  of  flight  (icing  and  nonicing 
conditions);  minimum  airspeeds  also  should  take  into  consideration  the  effects  of  various  types, 
amounts,  and  locations  of  ice  accumulation,  including  thin  amounts  of  very  rough  ice,  ice 
accumulated  in  SLD  icing  conditions,  and  tailplane  icing. 

The  circumstances  of  the  Westair  incident  indicate  that  despite  the  increased  availability  of 
icing-related  information  since  the  Comair  accident,  the  increase  in  icing-related  regulations  and 
the  heightened  awareness  of  the  hazards  of  structural  icing  among  the  operator/pilot  population 
that  has  resulted  from  recent  icing-related  aviation  accidents,  some  EMB-120  pilots  remain  less 
vigilant  to  decreases  in  airspeed  than  is  prudent.  Although  EMB-120  pilots  have  more  icing- 
related  information  available  to  them  now  than  they  did  before  the  Comair  flight  3272  accident, 
adequate  guidance  has  still  not  been  provided  on  minimum  operating  airspeeds  and  the  hazards  of 
various  types  and  amounts  (sometimes  imperceptible)  of  ice  accumulation.  Therefore,  the  Safety 
Board  believes  that  the  FAA  should  require  the  operators  of  all  turbine-engine  driven  airplanes 
(including  the  EMB-120)  to  incorporate  the  manufacturer’s  minimum  maneuvering  airspeeds  for 
various  airplane  configurations  and  phases  and  conditions  of  flight  in  their  operating  manuals  and 
pilot  training  programs  in  a  clear  and  concise  manner,  with  emphasis  on  maintaining  minimum  safe 
airspeeds  while  operating  in  icing  conditions. 


Stall  Warning/Protection  System 

The  stall  warning  systems  that  are  required  by  14  CFR  Part  25  are  intended  to  provide 
flightcrews  with  adequate  warning  of  proximity  to  the  stall  AOA;  however,  they  often  do  not 
provide  adequate  warning  when  the  airplane  is  operating  in  icing  conditions  in  which  the  stall 
AOA  is  markedly  reduced.  This  was  the  case  in  this  accident;  the  airplane  had  departed  from 
controlled  flight  before  activation  of  the  stick  shaker. 

The  accident  airplane’s  stall  waming/protection  system  used  information  from  the  sideslip 
sensor  and  the  right  and  left  AOA  sensors  to  determine  an  approaching  aerodynamic  stall 
condition.  Under  normal  conditions,  with  uncontaminated  airfoils  and  the  airplane  operating  with 
the  landing  gear  and  flaps  retracted,  EMB-120  stick  shaker  activation  would  occur  at  10°  and  the 
AOA  at  which  the  airplane  actually  stalled  would  be  18°,  providing  a  margin  of  about  8°. 
However,  with  the  wings  contaminated,  the  airflow  over  the  upper  wing  surface  is  disrupted,  the 
stall  airspeed  is  increased,  and  the  stall  AOA  is  reduced,19  thus  decreasing  the  margin  between 


19  FAA  and  NASA  wind/icing  tunnel  data  indicate  that  the  NACA  23012  airfoil  with  a  thin  layer  of  rough 
ice  on  the  leading  edge  with  a  small  ice  ridge  can  stall  at  angles  of  attack  as  low  as  5°  or  6°. 
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stall  warning  and  actual  stall.  The  decreased  margin  can  result  in  a  contaminated  airplane  stalling 
with  little  or  no  prestall  warning  (i.e.,  the  stick  shaker)  provided  to  the  pilots  and  at  a  higher 
airspeed  and  lower  AOA  than  a  pilot  might  expect.  Further,  if  a  pilot  was  confident  that  the 
airplane’s  stall  waming/protection  system  would  provide  an  adequate  stall  warning  margin,  that 
pilot  may  not  be  overly  concerned  about  the  flight  conditions  at  that  time. 

The  Safety  Board  notes  that  the  stall  warning  system  installed  on  the  Avions  de  Transport 
Regional  (ATR)  42/72  decreases  the  critical  AOA  for  aural  alert  and  stick  shaker  from  12.5°  to 
7.5°  when  the  anti-icing  system  is  activated.  The  7.5°  AOA  threshold  was  selected  by  ATR  to 
account  for  a  reduced  stall  AOA  with  an  ice  accumulation.  In  addition,  the  Safety  Board  is  aware 
that  stall  waming/protection  systems  exist  that  incorporate  airflow  sensors  into  their  logic  and 
adjust  the  stick  shaker/pusher  activation  to  compensate  for  the  dismptions  in  airflow  that  result 
from  ice  accumulation  on  the  airfoil. 

Because  the  accident  airplane’s  FDR  and  CVR  data  indicated  that  the  autopilot 
disengaged  and  the  roll  upset  occurred  before  die  stick  shaker  activated,  the  Safety  Board 
concludes  that  the  stall  warning  system  installed  in  the  accident  airplane  did  not  provide  an 
adequate  warning  to  the  pilots  because  ice  contamination  was  present  on  the  airplane’s  airfoils 
and  the  system  was  not  designed  to  account  for  aerodynamic  degradation  or  adjust  its  warning  to 
compensate  for  the  reduced  stall  warning  margin  caused  by  the  ice.  Thus,  the  Safety  Board 
believes  that  the  FAA  should  require  the  manufacturers  and  operators  of  all  airplanes  that  are 
certificated  to  operate  in  icing  conditions  to  install  stall  waming/protection  systems  that  provide  a 
cockpit  warning  (aural  warning  and/or  stick  shaker)  before  the  onset  of  stall  when  the  airplane  is 
operating  in  icing  conditions. 


Operation  of  the  Autopilot 

The  Safety  Board  was  unable  to  positively  determine  whether  the  autopilot  was  operating 
properly  based  on  physical  evidence  (impact  damage  precluded  functional  tests).  However,  based 
on  FDR  data  and  a  review  of  the  autopilot  design  characteristics,  the  Safety  Board  concludes  that 
the  accident  airplane’s  autopilot  was  capable  of  normal  operation  and  appeared  to  be  operating 
normally  during  the  last  minutes  of  the  accident  flight,  and  the  autopilot  disconnect  and  warning 
systems  operated  in  a  manner  consistent  with  their  design  logic. 

The  Safety  Board  evaluated  the  flightcrew’s  use  of  the  autopilot  as  it  affected  the  cues 
presented  to  the  pilots  about  the  impending  loss  of  control  and  the  behavior  of  the  ailerons  as  the 
loss  of  control  developed.  The  autopilot’s  actions  during  the  last  seconds  before  it  disengaged 
provided  some  visual  cues  that  could  have  warned  the  pilots  of  the  airplane’s  performance 
degradation.  For  example,  during  the  15  seconds  before  the  autopilot  disengaged,  it  moved  the 
control  wheel  to  command  the  ailerons  to  move  in  a  RWD  direction  while  the  flight  instruments 
and  the  pilots’  heading  selection  indicated  that  the  airplane  was  in  a  left  bank.  Although  it  would 
have  been  possible  for  the  pilots  to  observe  this  and  deduce  that  an  anomalous  flight  condition 
existed,  these  visual  cues  began  very  gradually  and  were  subtle  and  short  lived.  The  control  wheel 
did  not  move  more  than  10°,  and  the  roll  angle  did  not  exceed  30°  (only  slightly  greater  than  the 
normal  autopilot  bank  limit  for  the  selected  left  turn),  until  about  8  seconds  before  the  upset. 
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The  deviations  from  the  desired  airplane  attitude  were  becoming  noticeable  about  the  time  that 
the  pilots  were  increasing  engine  power  to  maintain  150  knots  and  continued  as  the  captain 
directed  the  first  officer’s  attention  to  the  airplane’s  airspeed  (about  5  seconds  before  the  upset). 
Given  this  distraction,  it  is  likely  that  the  subtle  visual  cues  that  were  available  were  not  adequate 
to  prompt  the  pilots  to  take  the  direct  and  aggressive  action  that  would  have  been  necessary  to 
avoid  the  upset. 

If  at  least  one  of  the  pilots  had  been  manually  monitoring  the  airplane’s  (autopilot’s) 
performance  by  maintaining  a  light  grip  on  the  control  wheel,  it  is  more  likely  that  the  autopilot- 
commanded  right  control  wheel  application  (control  wheel  movement  in  the  opposite  direction  to 
the  turn)  would  have  been  noticed  at  some  point  before  the  autopilot  disengaged.  However,  the 
pilots  could  not  have  identified  the  buildup  in  control  wheel  forces  that  would  have  preceded  and 
accompanied  the  RWD  control  wheel  movements  unless  the  autopilot  had  been  disengaged  and 
they  were  flying  the  airplane  manually. 

Postaccident  simulator  tests  indicated  that  throughout  most  of  the  airplane’s  left  roll,  even 
up  to  the  time  the  autopilot  disengaged,  the  pilots  could  have  prevented  the  loss  of  control  of  the 
airplane  by  decreasing  the  AOA.  However,  when  the  autopilot  suddenly  disengaged,  the  release 
of  the  autopilot’s  RWD  control  input  allowed  the  ailerons  to  move  rapidly  in  the  left  wing  down 
direction,  which  caused  the  airplane  to  immediately  roll  to  a  nearly  inverted  attitude. 

The  sudden  disengagement  of  the  autopilot  with  no  warning  to  the  flightcrew  is  an 
essential  difference  between  the  Comair  flight  3272  accident  and  the  Westair  flight  7233  incident 
(other  differences  include  the  following:  according  to  their  statements,  the  Westair  pilots  had 
activated  the  leading  edge  deicing  boots,  and  the  Westair  airplane’s  airspeed  was  below  its  target 
airspeed  for  about  3'A  minutes,  whereas  Comair’s  airspeed  was  below  the  target  airspeed  for  10 
seconds).  The  Westair  pilots  intentionally  disengaged  the  autopilot  and  resumed  flying  the 
airplane  manually  when  they  felt  the  airplane  shudder  or  rumble,  before  an  unusual  attitude 
developed.  Although  the  Westair  pilots  subsequently  experienced  several  roll  oscillations  and 
deviated  600  feet  below  their  assigned  altitude  before  they  extended  15°  of  flaps,  they  were  able 
to  regain  control  of  the  airplane.  Comair  flight  3272’s  autopilot  automatically  disengaged,  and, 
because  of  the  left  roll  tendency,  the  airplane  rolled  left  to  a  nearly  inverted  attitude  almost 
immediately  after  the  autopilot  disengaged — before  the  pilots  had  their  hands  on  the  controls. 
The  Westair  airplane  remained  moderately  more  controllable  because  the  pilots  had  their  hands  on 
the  control  wheel  and  were  manually  flying  the  airplane  as  soon  as  the  autopilot  was  disengaged; 
further,  the  excessive  roll  oscillations  did  not  begin  until  about  4  seconds  after  the  autopilot 
disengaged.  It  is  likely  that  the  Comair  flight  3272  upset  event  would  have  been  more 
controllable  if  the  Comair  pilots  had  recognized  the  airplane’s  degraded  aerodynamic  condition 
and  disengaged  the  autopilot  to  fly  the  airplane  manually  before  the  autopilot  disengaged 
automatically  and  unexpectedly.  The  Safety  Board  concludes  that,  had  the  pilots  been  flying  the 
airplane  manually  (without  the  autopilot  engaged),  they  likely  would  have  noted  the  increased 
RWD  control  wheel  force  needed  to  maintain  the  desired  left  bank,  become  aware  of  the 
airplane’s  altered  performance  characteristics,  and  increased  their  airspeed  or  otherwise  altered 
their  flight  situation  to  avoid  the  loss  of  control. 
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After  the  ATR-72  accident  near  Roselawn,  Indiana,  the  Safety  Board  issued  Urgent  Safety 
Recommendation  A-94-184  to  the  FAA  recommending,  in  part,  that  it  prohibit  ATR-42/72  pilots 
from  using  the  autopilot  in  icing  conditions  because  of  the  autopilot’s  ability  to  mask  the 
airplane’s  changing  flight  condition.  The  FAA’s  response  prohibited  ATR  42/72  pilots  from  using 
the  autopilot  in  icing  conditions  unless  specific  modifications  were  accomplished  or  alternative 
procedures  and  training  were  adopted,  and  the  Safety  Board  reclassified  Safety  Recommendation 
A-94-184  “Closed — Acceptable  Action.”  Further,  based  on  the  FAA’s  AD  96-09-24,  in  the 
summer  of  1996,  Comair  revised  its  manuals  (based  on  Embraer  changes)  to  indicate  that  because 
“the  autopilot  may  mask  cues  that  indicate  adverse  changes  in  handling  characteristics,  use  of  the 
autopilot  is  prohibited”  in  SLD  icing  conditions. 

However,  the  circumstances  of  the  Comair  accident  demonstrate  that  restricting  use  of  the 
autopilot  only  when  the  airplane  is  operating  in  SLD  icing  conditions  may  not  be  adequate. 
Moreover,  an  airplane  may  encounter  a  hazardous  flight  condition  from  use  of  the  autopilot  in 
icing  conditions  that  may  not  be  perceptible  to  the  flightcrew.  Case  histories  indicate  that  relying 
on  pilots  to  activate  deicing  boot  systems  or  maintain  minimum  airspeeds  in  icing  conditions  does 
not  ensure  safe  operation  of  an  airplane  in  icing  conditions;  pilots  may  not  always  be  attentive 
enough  to  airspeeds,  they  may  not  recognize  the  onset  of  ice  accumulation  to  trigger  deicing  boot 
activation,  or  deicing  boot  activation  may  not  be  sufficient  to  prevent  icing-related  flight  control 
anomalies  in  some  conditions  because  of  intercycle  icing.  However,  if  the  pilots  of  Comair  flight 
3272  had  intentionally  disengaged  the  autopilot  upon  the  onset  of  ice  accretion,  the  autopilot 
would  not  have  masked  the  tactile  cues  to  the  airplane’s  aerodynamic  degradation,  nor  would  the 
autopilot  have  automatically  disengaged  at  a  subsequent,  more  critical  time.  Thus,  the  pilots 
would  not  have  initiated  their  recovery  from  an  extremely  unusual  attitude. 

The  Safety  Board  considered  whether  operation  of  the  autopilot  in  the  “[Vi  bank]  angle” 
mode,  as  recommended  in  the  “Descent/Holding/Landing”  section  of  Embraer’ s  OB  No. 
120-002/96,  “Operation  in  Icing  Conditions,”  might  provide  an  adequate  level  of  safety  for  use  of 
the  autopilot  during  maneuvering  flight  in  icing  conditions.  The  Safety  Board  notes  that  the 
sideslip  and  severe  asymmetric  degradation  of  the  accident  airplane  appeared  not  to  have  begun 
(based  on  FDR  data)  until  the  airplane  reached  20°  of  left  bank  (at  1554:10).  However,  the 
Safety  Board  also  notes  that  the  autopilot’s  Vi  bank  angle  mode  only  applies  to  the  lateral  control 
mode  in  which  it  is  selected— when  the  autopilot  lateral  control  mode  changes  during  flight  (either 
pilot-commanded,  or  pilot  preselected,  such  as  during  the  transition  from  heading  mode  to 
approach  mode),  the  autopilot  reverts  to  commanding  standard  bank  angles.  Thus,  the  pilot 
would  need  to  reengage  the  '/a  bank  angle  mode  in  the  new  lateral  control  mode,  if  '/2  bank  angle 
mode  is  desired.  This  would  result  in  an  increased  pilot  workload  during  the  approach  phase  of 
flight  (already  a  high  workload  phase  of  flight)  or  the  task  (reengaging  '/a  bank  angle  mode)  might 
not  be  accomplished.  Thus,  the  Safety  Board  considers  it  unlikely  that  the  use  of  the  autopilot’s 
'/a  bank  angle  mode  while  operating  in  icing  conditions  (as  recommended  in  Embraer’ s 
OB  120-002/96)  would  ensure  an  adequate  level  of  safety  to  EMB-120  pilots  operating  in 
conditions  conducive  to  the  formation  of  structural  ice. 

Therefore,  the  Safety  Board  concludes  that  disengagement  of  the  autopilot  during  all 
operations  in  icing  conditions  is  necessary  to  enable  pilots  to  sense  the  aerodynamic  effects  of 
icing  and  enhance  their  ability  to  retain  control  of  the  airplane.  Because  there  is  no  reason  to 
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believe  that  these  circumstances  may  be  confined  to  the  ATR-72  and  the  EMB-120,  the  Safety 
Board  believes  that  the  FAA  should  require  all  operators  of  turbopropeller-driven  air  carrier 
airplanes  to  require  pilots  to  disengage  the  autopilot  and  fly  the  airplane  manually  when  they 
activate  the  anti-ice  systems. 

Further,  based  on  this  accident  and  other  air  carrier  incidents  (such  as  the  Evergreen 
International  B-747),  the  Safety  Board  has  considered  the  feasibility  and  value  of  a  cockpit 
warning  when  an  airplane  first  exceeds  the  autopilot’s  maximum  bank  and/or  pitch  command  ■» 

limits  to  alert  pilots  to  an  anomalous  situation.  According  to  AlliedSignal  personnel,  it  is  possible 
to  adjust  their  recent  model  ground  proximity  warning  systems  (GPWS)  to  provide  a  cockpit  bank 
angle  warning  when  the  airplane’s  bank  angle  exceeds  the  autopilot’s  normal  command  limit  with  ’ 

the  autopilot  activated.  The  Safety  Board  concludes  that  if  the  pilots  of  Comair  flight  3272  had 
received  a  GPWS,  autopilot,  or  other  system-generated  cockpit  warning  when  the  airplane  first 
exceeded  the  autopilot’s  maximum  bank  command  limits  with  the  autopilot  activated,  they  might 
have  been  able  to  avoid  the  unusual  attitude  condition  that  resulted  from  the  autopilot’s  sudden 
disengagement.  Therefore,  the  Safety  Board  believes  that  the  FAA  should  require  all 
manufacturers  of  transport-category  airplanes  to  incorporate  logic  into  all  new  and  existing 
transport-category  airplanes  that  have  autopilots  installed  to  provide  a  cockpit  aural  warning  to 
alert  pilots  when  the  airplane’s  bank  and/or  pitch  exceeds  the  autopilot’s  maximum  bank  and/or 
pitch  command  limits. 

FAA  Continuing  Airworthiness  Oversight  Issues 

The  Safety  Board  notes  that,  like  the  ATR-42  and  -72,  the  EMB-120  exhibited  a  history 
of  icing-related  upsets/losses  of  control  before  being  involved  in  a  related  fatal  accident.  At  the 
time  of  the  Comair  accident,  six  icing-related  EMB-120  events  had  been  documented,  the  first  of 
which  occurred  in  June  1989.20  The  Safety  Board’s  review  of  these  incidents  shows  that  before 
the  Comair  accident,  the  EMB-120  fleet  had  experienced  repeated  instances  of  roll  upsets 
associated  with  ice  accumulations  that  the  pilots  either  did  not  observe  or  did  not  consider 
sufficient  to  prompt  activation  of  the  deicing  boots. 

FAA  and  Embraer  personnel  had  noted  the  recurring  events,  and  the  FAA  presented  a 
summary  of  the  six  events  at  an  FAA/industry  meeting  (attended  by  Safety  Board  staff)  on 
November  7,  1995.  Further,  the  FAA  and  Embraer  discussed  the  events  with  representatives 
from  Comair  and  other  operators  at  a  meeting  on  November  15,  1995,  and  additional  discussion 
took  place  during  the  EMB-120  SLD  icing  tanker  tests  in  December  1995.  An  FAA  engineer 
reviewed  these  six  incidents  in  a  draft  report  dated  January  26,  1996. 

The  Safety  Board  has  been  unable  to  obtain  information  about  the  specific  disposition  of 
the  draft  report  within  the  FAA,  although  the  FAA  asserted  after  the  accident  that  this  report  did 
not  reflect  the  official  views  of  the  FAA.  Nevertheless,  the  Safety  Board  notes  that  more  than 


20  Similarly,  before  the  ATR-72  accident  at  Roselawn,  Indiana,  the  FAA  had  been  aware  of  a  number  of 
prior  ATR  upset  events.  The  FAA  had  concluded  that  these  incidents  were  essentially  pilot-induced  stall  events; 
however,  further  investigation  revealed  that  there  were  more  complex  airplane  controllability  issues  involved  in  the 
ATR  upset  events. 
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1  year  before  the  accident,  at  least  some  members  of  the  FAA  certification  staff  responsible  for 
handling  EMB-120  icing  issues  were  concerned  about,  and  were  considering  recommendations 
on,  the  following  issues:  1)  the  airplane’s  roll  behavior  with  ice  accretion,  2)  high  drag  from  ice 
accretions  that  are  not  considered  by  the  flightcrew  to  warrant  activating  the  deicing  boots,  3) 
inadequate  stall  warning  in  icing  conditions,  4)  inadequate  stall  margin  with  the  airspeed 
established  for  use  in  icing  conditions,  and  5)  problems  stemming  from  the  use  of  the  autopilot  in 
these  conditions. 

The  FAA’s  official  response  to  the  six  preaccident  EMB-120  icing-related  events,  as 
expressed  to  the  Safety  Board  by  aircraft  certification  office  (ACO)  personnel,  was  that  these 
incidents  shared  a  common  factor— flightcrew  failure  to  activate  the  leading  edge  deicing  boots. 
The  FAA  apparently  believed  that  the  EMB-120  was  safe  to  operate  in  icing  conditions  as  long  as 
the  boots  were  operated. 

Hence,  the  FAA’s  primary  action  regarding  EMB-120  icing  before  the  accident  was  to 
approve  the  Embraer-proposed,  CTA-approved  revision  to  the  AFM  that  pilots  activate  the  boots 
at  the  first  indication  of  ice  accumulation  (revision  43).  In  doing  so,  the  FAA  ACO  apparently  did 
not  accept  the  draft  report’s  conclusions,  which  recognized  that  pilots  would  not  activate  the 
boots  if  they  .did  not  recognize  ice  accumulation,  that  an  engaged  autopilot  masked  the  tactile 
cues  of  icing,  and  that  under  these  conditions,  the  flightcrew  also  could  be  deprived  of  an 
adequate  stall  warning. 

The  Safely  Board  notes  with  disappointment  that  this  was  the  latest  in  a  series  of  limited 
actions  taken  by  the  FAA  to  address  the  problems  of  structural  icing  in  transport  airplane 
certification  and  operation.  Basic  knowledge  about  the  aerodynamics  of  icing  (including  the 
knowledge  regarding  the  hazards  of  small  amounts  of  surface  roughnessAce)  has  been  well 
established  for  the  past  50  years,  and  there  is  nothing  that  has  been  learned  in  the  most  recent, 
postaccident  wind  tunnel  tests  and  analyses  that  could  not  have  been  learned  before  this  Comair 
accident. 


Many  of  the  concerns  raised  about  icing  in  this  investigation  were  previously  identified  by 
the  Safety  Board  as  early  as  its  September  1981  study  on  icing  avoidance  and  protection.  The 
study  raised  concerns  about  the  adequacy  of  the  Part  25  appendix  C  envelope  and  icing 
certification  and  the  difficulties  in  defining  and  forecasting  icing  conditions;  as  a  result  of  the 
study,  the  Safety  Board  recommended,  in  part,  that  the  FAA  evaluate  individual  aircraft 
performance  in  icing  conditions  and  establish  operational  limits,  review  icing  criteria  in  Part  25 
and  expand  (adjust)  the  Part  25  appendix  C  envelope  as  necessary,  and  establish  standardized 
procedures  for  icing  certification.  For  many  years,  the  FAA  did  not  respond  positively  to  the 
Safety  Board’s  recommendations,  indicating  that  icing  was  not  a  significant  problem  for  airplanes 
certificated  under  Part  25  appendix  C.  However,  subsequent  icing-related  accidents  at  Pasco, 
Washington  (in  December  1989),  and  Beckley,  West  Virginia  (in  January  1991),  revealed  that 
flight  control  anomalies  could  result  from  tailplane  icing  and  an  icing-related  accident  at 
Cleveland,  Ohio  (in  February  1991),  revealed  that  slightly  rough  ice  accumulations  on  the  wing 
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upper  surface  can  result  in  hazardous  flight  handling  characteristics.21  Further,  the  October  1994 
ATR-72  accident  at  Roselawn,  Indiana,  demonstrated  that  icing  outside  the  Part  25  appendix  C 
envelope  could  be  a  significant  problem  for  airplanes  certificated  to  operate  in  icing  conditions. 

After  this  series  of  fatal  accidents  (all  of  which  involved  icing  in  transport  airplanes 
operated  in  air  carrier  service)  drew  attention  to  icing-related  hazards,  the  FAA  reacted 
incrementally  to  tailplane  icing,  then  rough  ice  accumulations  on  the  upper  wing,  and  then,  later, 
to  runback  icing  (SLD).  The  Safety  Board  recognizes  that  following  the  Comair  flight  3272 
accident,  the  FAA  began  an  important  icing-related  research  program  with  Embraer  and  the 
UIUC.  This  work  has  resulted  in  findings  about  the  effects  of  thin/rough  ice  accretions  and  ice 
ridges  on  boots,  with  other  possible  factors  (such  as  intercycle  icing  and  residual  ice  on  boots)  as 
yet  unknown  or  unresolved.  However,  had  the  FAA  adequately  responded  to  the  Safety  Board’s 
1981  icing  recommendation,  the  earlier  accidents,  or  the  concerns  expressed  in  its  own  staffs 
draft  report  on  the  EMB-120  and  conducted  a  thorough  program  of  icing-related  research  that 
defined  a  course  of  action  to  prevent  similar  incidents  by  addressing  the  certification  and 
operational  issues  (autopilot  use  in  icing  conditions,  no  autopilot  bank  angle  exceedence  warning, 
no  stall  waming/protection  system  adjustment  for  icing  conditions,  the  effects  of  thin,  rough  ice 
and  SLD  accretions,  etc.),  this  accident  would  likely  have  been  avoided. 

The  Safety  Board  notes  that  the  failure  of  the  FAA  to  promptly  and  systematically 
address  these  certification  and  operational  issues  resulted  in  the  pilots  of  Comair  flight  3272  being 
in  a  situation  in  which  they  lacked  sufficient  tools  (autopilot  bank  angle  warning,  adjusted  stall 
waming/protection  system,  ice  detection  system,  adequate  deice  procedures)  and  information 
(airspeed  guidance,  hazards  of  thin  rough  ice  accretions,  and  absence  of  ice  bridging)  to  operate 
safely.  The  Safety  Board  concludes  that  despite  the  accumulated  lessons  of  several  major 
accidents  and  (in  the  case  of  the  EMB-120)  the  specific  findings  of  a  staff  engineer,  the  FAA 
failed  to  adopt  a  systematic  and  proactive  (rather  than  incremental  and  reactive)  approach  to  the 
certification  and  operational  issues  of  turbopropeller-driven  transport  airplane  icing,  which  was 
causal  to  this  accident. 


Icing  Certification  Requirements 

The  Safety  Board  reviewed  EMB-120  test  data  from  the  original  certification  of  the 
airplane  for  flight  in  icing  conditions  (U.S.  and  Canadian  tests)  and  the  subsequent  SLD  icing 
certification  tests,  which  were  conducted  in  1995  as  a  result  of  the  ATR-72  accident  near 
Roselawn,  Indiana.  The  Safety  Board  found  no  evidence  that  the  EMB-120  did  not  satisfy  the 
tests  to  which  it  was  subjected;  in  fact,  during  these  tests,  Embraer  demonstrated  the  airplane’s 
flight  handling  qualities  under  conditions  that  exceeded  the  boundaries  of  the  Part  25  appendix  C 
envelope  in  terms  of  LWC. 


21  There  have  been  five  DC-9  series  10  airplane  takeoff  accidents  attributed  to  upper  wing  ice 
contamination  in  the  United  States  since  1968.  Although  these  accidents  involved  tuibojet-driven  airplanes  (not 
tuibopropeller-driven  airplanes,  like  the  other  icing-related  incidents/accidents  discussed  in  this  report),  the  issue 
of  the  FAA’s  failure  to  address  icing-related  operational  and  certification  issues  is  pertinent  to  all  airplanes 
certificated  for  flight  in  icing  conditions. 
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Despite  the  apparent  fulfillment  of  all  icing  certification  requirements  by  the  EMB-120, 
Comair  flight  3272  crashed  after  apparently  accreting  a  thin  layer  of  rough,  “sandpaper-type”  ice’ 
in  icing  conditions  that  likely  fell  mostly  within  the  boundaries  of  Part  25  appendix  C,  although 
droplets  as  large  as  400  microns  might  have  been  present.  ° 

Consequently,  the  Safety  Board  reviewed  the  adequacy  of  the  current  FAA  requirements 
t  for  the  certification  of  airplanes  for  flight  in  icing  conditions.  For  an  airplane  to  be  certificated  for 
flight  in  icing  conditions,  the  FAA  requires  the  manufacturer  to  demonstrate  a  limited  number  of 
test  data  points  within  the  Part  25  appendix  C  envelope.  The  FAA’s  icing  certification 
requirements  are  based  on  fully  functioning  and  operating  anti-icing  and  deicing  systems 
Although  there  is  no  requirement  for  manufacturers  to  consider  the  effects  of  delayed  activation 
of  ice  protection  systems,  intercycle  or  residual  ice  accumulations,  or  other  variables  that  might 
result  in  significant  aerodynamic  effects,  Embraer  exceeded  the  minimum  FAA  requirements  when 
Embraer  tested  the  EMB-120  with  %-inch  (U.S.)  and  1-inch  (Canada)  ice  accretions/shapes 
during  initial  icing  certification.  Certification  records  indicate  that  the  EMB-120  successfully 
exhibited  satisfactory  flight  handling  characteristics  with  3-inch  ram’s  horn  ice  shapes  installed  on 
unprotected  surfaces.  Further,  during  the  SLD  icing  controllability  tests,  the  FAA  tested  the 
EMB-120  with  quarter-round  artificial  ice  shapes  as  large  as  1  inch  located  at  the  aft  edge  of  the 
farthest  aft  inflatable  deicing  boot  segment  (to  represent  ice  accumulated  in  icing  conditions  that 
fall  outside  the  Part  25  appendix  C  envelope).  The  airplane  exhibited  full  lateral  controllability 
and  satisfactory  stall  warning  characteristics  in  this  condition.23 

However,  Embraer  had  not  demonstrated  (nor  was  the  company  required  by  the 
certification  authorities  to  demonstrate)  the  EMB-120’s  performance  in  other  ice  configurations 
that  would  result  from  weather  conditions  within  the  Part  25  appendix  C  LWC  and  droplet  size 
envelope,  including  realistic  ice  shapes  (or  natural  ice)  representing  a  thin  layer  of  sandpaper-type 
ice  with  a  small  ice  ridge  (as  may  have  been  experienced  by  Comair  flight  3272).  Postaccident 
icing  and  wind  tunnel  information  indicated  that  with  a  small  ice  ridge  along  that  thin  rough 
surface,  the  aerodynamic  effect  on  handling  and  stall  margin/stall  warning  (reduced  stall  AOA  and 
rapid  decrease  in  lift)  can  be  worse  than  any  of  the  ice  shapes  that  the  FAA  required  for  icing 
certification. 

I 

The  Safety  Board  s  review  of  data  from  natural  icing  flight  tests  revealed  that  the 
airplane’s  handling  characteristics  were  evaluated  with  14-inch  accretions  on  protected  surfaces 
and  that  the  deicing  boots’  ability  to  remove  ice  accretions  of  up  to  14-inch  was  assessed. 


For  U.S.  (FAA)  icing  certification,  the  EMB-120  was  tested  with «/« inch,  '/2  inch,  and  %  inch  of  natural 
ice  on  protected  surfaces,  up  to  4  inches  of  natural  ice  accumulation  on  unprotected  airfoil  surfaces  and  3-inch 
ram  s  horn  artificial  ice  shapes  on  unprotected  surfaces;  except  for  the  V<-inch  natural  ice  on  protected  surfaces 

“es®  C°J^T  C0Uld  bC  encountered  whi,e  operating  in  icing  conditions  in  accordance  with  procedures  outlined 
in  the  EMB-120  AFM.  However,  for  Canadian  icing  certification,  the  EMB-120  was  tested  with  artificial  ice 
s  pes  representing  conditions  considered  to  be  outside  normal  operation  with  deicing  boots  activated  (1-inch 
ram  s  horn  ice  shapes  on  protected  surfaces). 

23  Although  some  control  wheel  force  exceedences  were  observed,  tanker  tests  identified  more  realistic  ice 
shapes;  dining  subsequent  tests  with  the  realistic  ice  shapes,  no  excessive  control  wheel  forces  or  other  anomalies 
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Embraer  was  not  required  to  demonstrate  the  EMB-120’s  stall  characteristics  in  adverse 
operational  scenarios,  including  delayed  boot  activation,  intercycle  ice  accretion,  or  residual  ice  on 
boots.  As  a  result  of  the  existing  icing  certification  procedures,  the  FAA  did  not  account  for  a 
thin  ice  accumulation  (as  was  identified  during  this  investigation,  and  which  may  not  be  observed 
or  perceived  by  pilots  to  be  a  threat)  that  could  result  in  a  more  hazardous  situation  than  the 
3-inch  ram’s  horn  shape  (which  is  readily  recognizable  by  pilots  as  a  hazard  and  would  certainly 
prompt  activation  of  the  boots).  The  Safety  Board  is  concerned  that  there  may  be  other 
unaccounted  for  ice  shapes  and/or  accretion  patterns  that  could  result  in  potentially  hazardous 
performance  degradation. 

The  Safety  Board  is  also  concerned  that  the  current  icing  certification  process  is  overly 
dependent  upon  pilot  performance;  the  FAA  has  long  based  its  icing  certification  policies  and 
practices  on  the  assumption  that  pilots  will  perform  their  duties  without  error  or  misperception. 
FAA  icing-related  publications  indicate  that  if  ice  formations  other  than  those  considered  in  the 
certification  process  are  present,  the  airplane’s  airworthiness  may  be  compromised.  After  an 
airplane  is  certificated  by  the  FAA  for  flight  in  appendix  C  icing  conditions,  it  becomes  primarily 
the  pilots’  responsibility  to  ensure  that  the  airplane  is  operated  in  icing  conditions  for  which  it  was 
certificated.  However,  as  noted  during  the  investigation  of  the  ATR-72  accident  at  Roselawn, 
during  normal  flight  operations,  pilots  often  cannot  tell  the  difference  between  icing  conditions 
that  fall  within  the  appendix  C  envelope  and  icing  conditions  outside  the  appendix  C  envelope.24 
(For  example,  a  pilot  cannot  differentiate  between  40  micron  droplets  and  100  micron  droplets.) 
Because  pilots  often  cannot  determine  whether  icing  conditions  are  consistent  with  “those 
considered  in  the  certification  process”  (i.e.,  limited  points  within  the  appendix  C  certification 
envelope),  or  not  (i.e.,  SLD  icing  conditions,  or  other  potentially  hazardous  conditions  that  were 
not  subjected  to  testing,  analysis,  or  demonstration  during  icing  certification  work),  it  is  virtually 
inevitable  that  the  airplane  will  unknowingly  be  operated  in  icing  conditions  that  fall  outside  the 
certification  envelope,  or  in  which  the  airplane  had  not  demonstrated  that  it  could  operate  safely. 

Further,  as  has  been  recognized  for  50  years  or  more,  and  demonstrated  in  accidents  in  the 
1970s,  1980s,  and  early  1990s,  and  then  again  in  the  Comair  flight  3272  accident,  surface 
roughness/ice  accretions  that  may  be  imperceptible  or  appear  insignificant  to  pilots  can  adversely 
affect  the  operation  of  the  airplane.  However,  because  of  the  imperceptible  or  seemingly 
insignificant  nature  of  those  accretions,  pilots  who  operate  the  airplane’s  deicing  boots  in 
accordance  with  manufacturer’s  guidance  (that  advises  them  to  wait  until  a  recommended 
thickness  of  ice  accretes)  may  not  activate  the  deicing  boots  under  these  circumstances.  An 
article  written  by  a  Douglas  Aircraft  Company  design  engineer  (published  in  January  1979) 
indicated  that  although  most  pilots  are  aware  of  the  adverse  aerodynamic  effects  of  large  amounts 
of  ice,  pilots  appear  less  aware  that  seemingly  insignificant  amounts  of  thin,  rough  ice  on  an 
airfoil’s  leading  edge  can  significantly  degrade  the  airplane’s  flight  characteristics.  The  deicing 
boot  operating  procedures  now  contained  in  most  airplane  manuals  contribute  to  this  lack  of 
awareness  by  advising  pilots  to  wait  until  a  recommended  thickness  of  ice  accretes. 


24  The  FAA  has  since  required  manufacturers  of  tuibopropeller-driven  airplanes  to  develop  visual  cues  for 
SLD  icing;  however,  the  cues  were  based  on  vety  limited  testing.  Thus,  the  Safety  Board  is  not  convinced  that 
such  cues  will  exist  for  all  icing  conditions  outside  the  appendix  C  icing  envelope. 
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During  the  investigation  of  this  accident,  arguments  were  made  that  the  pilots  caused  the 
accident  because  they  accepted  an  airspeed  10  knots  slower  than  Comair’s  FSM  recommended 
for  holding  in  icing  conditions.  However,  the  Safety  Board  notes  that  an  EMB-120  loaded  and 
configured  similar  to  Comair  flight  3272,  and  operated  at  150  knots  without  any  ice  accretions, 
would  have  a  36-knot  margin  between  its  operating  airspeed  and  the  stall  speed.  This  margin 
would  likely  appear  to  be  an  adequate  safety  margin  to  a  pilot  who  did  not  recognize  that  the 
airplane  was  accumulating  ice  or  did  not  believe  that  enough  ice  had  accumulated  to  warrant 
?  activation  of  the  deicing  boots.  The  flight  handling  testing  that  occurred  during  the  icing 
certification  process  did  not  identify  that  control  problems  that  were  observed  in  the  accident 
airplane’s  performance  at  an  airspeed  of  about  156  knots  (only  4  knots  below  the  160-knot 
■  minimum  speed  for  flight  in  icing  conditions  set  by  the  FAA  following  the  Comair  accident)  with 
only  a  small  amount  of  ice  accreted  on  the  deicing  boots.  It  is  possible  that  if  the  FAA  had 
required  manufacturers  to  conduct  tests  with  small  amounts  of  rough-textured  ice  accreted  on  the 
protected  surfaces  (as  might  occur  before  boot  activation  and  between  boot  cycles)  during  icing 
certification  testing,  the  absence  of  an  adequate  safety  margin  above  the  stall  speed  would  have 
been  identified.  Further,  the  FAA  could  have  ensured  pilot  awareness  of  icing  and  adequate  stall 
warning  by  requiring  manufacturers  to  install  ice  detectors25  and  stall  warning  systems  with 
reduced  AOA  thresholds  for  operations  in  icing  conditions. 

Based  on  its  concerns  that  the  current  icing  certification  standards  did  not  require  testing 
for  all  realistic  hazardous  ice  accretion  scenarios,  in  its  1981  icing-related  safety  study,  the  Safety 
Board  recommended  that  the  FAA  review  the  adequacy  of  the  1950s-era  Part  25  appendix  C  icing 
envelope,  update  the  procedures  for  aircraft  icing  certification,  and  oversee  the  manufacturers’ 
evaluations  of  aircraft  performance  in  various  icing  conditions.  The  circumstances  of  the  Comair 
flight  3272  accident  demonstrated  again  the  continuing  need  for  these  FAA  actions.  The  Safety 
Board  considers  the  information  that  has  been  available  regarding  thin,  rough  ice  accretions 
sufficient  to  have  prompted  the  FAA  to  require  additional  testing  within  the  appendix  C  envelope 
to  demonstrate  the  effects  of  thin,  rough  ice  as  part  of  the  icing  certification  process.  Had  the 
FAA  required  such  additional  testing,  the  resultant  information  regarding  the  stall  margin  and 
operational  envelope  of  the  EMB-120  might  have  been  used  to  define  minimum  airspeeds  for 
operating  the  airplane  in  icing  conditions.  Therefore,  based  on  its  review  of  the  history  of  icing 
information,  the  icing-related  incident  and  accident  history,  the  EMB-120  initial  icing  certification 
data,  the  EMB-120  SLD  icing  controllability  test  results,  and  the  circumstances  of  this  accident, 
the  Safety  Board  concludes  that  the  icing  certification  process  has  been  inadequate  because  it  has 
not  required  manufacturers  to  demonstrate  the  airplane’s  flight  handling  and  stall  characteristics 
under  a  sufficiently  realistic  range  of  adverse  ice  accretion/flight  handling  conditions. 

As  a  result  of  its  investigation  of  the  1994  Roselawn  accident,  the  Safety  Board  issued 
Safety  Recommendations  A-96-54  and  A-96-56  (currently  classified  “Open— Acceptable 
Response”),  which,  respectively,  stated  that  the  FAA  should  do  the  following: 

Revise  the  icing  criteria  published  in  14  CFR  Parts  23  and  25,  in  light  of  both  recent 
research  into  aircraft  ice  accretion  under  vaiying  conditions  of  liquid  water  content, 
drop  size  distribution,  and  temperature,  and  recent  developments  in  both  the  design 


25  Rosemount  ice  detectors  were  first  used  in  militaiy  and  transport-categoiy  airplanes  in  the  early  1970s. 


28 


and  use  of  aircraft.  Also,  expand  the  Appendix  C  icing  certification  envelope  to 
include  freezing  drizzle/freezing  rain  and  mixed  water/ice  crystal  conditions,  as 
necessary. 

Revise  the  icing  certification  testing  regulation  to  ensure  that  airplanes  are  properly 
tested  for  all  conditions  in  which  they  are  authorized  to  operate,  or  are  otherwise 
shown  to  be  capable  of  safe  flight  into  such  conditions.  If  safe  operations  cannot  be 
demonstrated  by  the  manufacturer,  operational  limitations  should  be  imposed  to  ^ 

prohibit  flight  in  such  conditions  and  flightcrews  should  be  provided  with  the  means  to 
positively  determine  when  they  are  in  icing  conditions  that  exceed  the  limits  for  aircraft 
certification.  i 

Further,  based  on  a  perceived  depletion  of  the  FAA’s  technical  expertise,  the  1993  U.S. 

General  Accounting  Office  report  entitled  “Aircraft  Certification:  New  FAA  Approach  Needed  to 
Meet  Challenges  of  Advanced  Technology”  recommended  that  the  FAA  should  hire  more 
technical  subject  matter  specialists  in  various  areas,  including  that  of  environmental  icing.  After 
the  Roselawn  accident,  the  FAA  developed  a  three-phase,  multi-pronged  plan  to  address  icing- 
related  concerns,  including  operational  issues,  forecasting/defining  icing  conditions,  certification 
issues,  validating  simulation  methods,  identifying  the  aerodynamic  effects  of  accretion,  and 
identifying  visual  cues  to  various  hazardous  icing  conditions  and  (about  2  years  after  the 
Roselawn  accident)  hired  its  current  Environmental  Icing  National  Resource  Specialist  (NRS).  In 
January  1998,  the  FAA’s  Environmental  Icing  NRS  updated  the  Safety  Board  on  the  FAA’s 
progress  with  its  plan,  indicating  that  the  first  two  phases  have  been  completed  and  progress  is 
bang  made  in  several  aspects  of  Phase  HI  (specifically  in  the  areas  of  understanding  the  effects  of 
various  ice  accretions,  operational  issues  such  as  bridging,  and  development  of  ice 
detection/protection  equipment). 

The  Safety  Board  notes  that  the  FAA’s  three-phase  plan  could  potentially  satisfy  the  need 
for  a  comprehensive  review  of  all  aspects  of  structural  icing  in  turbopropeller-driven  transport 
airplanes.  However,  the  regulatory/certification  changes  addressed  during  Phase  IE  have 
encountered  delays.  FAA  personnel  reported  to  the  Safety  Board  that  their  attempts  to  produce 
an  advisory  circular  (AC)  that  would  appropriately  revise  methods  of  compliance  with  Parts  23/25 
and  Part  25  appendix  C  were  not  successful;26  therefore,  they  changed  their  approach  to  the 
problem  and  issued  two  of  three  proposed  ACs  addressing  changes  to  methods  of  compliance  and 
are  going  through  the  rulemaking  process  for  the  needed  regulatory  changes.  According  to  FAA 
personnel,  ACs  addressing  methods  of  compliance  with  Parts  23  and  25  were  issued  on  August 
19,  1998,  and  March  31,  1998,  respectively,  and  the  newly  created  AC  25.1419  is  currently  in 
draft  form,  with  no  estimated  issue  date  available.  FAA  personnel  estimated  that  the  rulemaking 
process  will  probably  not  be  completed  until  January  2000. 

In  response  to  the  Safety  Board’s  Safety  Recommendations  A-96-54  and  A-96-56,  the 
FAA  assigned  aviation  rulemaking  advisory  committee  (ARAC)  working  groups  to  accomplish,  in 
part,  the  following:  to  establish  criticality  of  ice  accretions  on  airplane  performance  and  handling 


26  According  to  the  FAA’s  Environmental  Icing  NRS,  FAA  legal  personnel  determined  that  portions  of 
the  AC  appeared  to  require  regulatory  changes  and  therefore  could  not  be  addressed  solely  by  means  of  an  AC. 
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qualities,  to  develop  icing  certification  criteria  for  the  safe  operation  of  airplanes  in  icing 
conditions  that  are  not  covered  by  the  current  certification  envelope,  and  to  consider  the 
development  of  a  regulation  requiring  the  installation  of  ice  detectors  or  equivalent  means  to  warn 
flightcrews  of  ice  accumulations.  The  Safety  Board  appreciates  the  efforts  of  the  FAA 
Environmental  Icing  NRS  and  the  ARAC  working  groups,  and  the  Safety  Board  concludes  that 
the  work  conducted  by  the  FAA  Environmental  Icing  NRS  and  the  ARAC  icing-related  working 
groups  is  of  crucial  importance  to  the  future  safety  of  icing  operations.  Consequently,  the  Safety 
Board  believes  that  the  FAA  should  expedite  the  research,  development,  and  implementation  of 
revisions  to  the  icing  certification  testing  regulations  to  ensure  that  airplanes  are  adequately  tested 
for  die  conditions  in  which  they  are  certificated  to  operate;  the  research  should  include 
identification  (and  incorporation  into  icing  certification  requirements)  of  realistic  ice  shapes  and 
their  effects  and  criticality.  Further,  the  Board  reiterates  Safety  Recommendation  A-96-54  and  A- 
96-56  to  the  FAA. 

The  Safety  Board  further  notes  that  according  to  the  FAA’s  EMB-120  Aircraft 
Certification  Program  Manager  and  Environmental  Icing  NRS,  the  new  standards,  criteria  and 
methods  of  compliance  contained  in  Parts  23  and  25  and  corresponding  ACs  that  are  currently 
being  developed  would  be  applied  only  to  future  icing  certification  projects  and  would  not  be 
retroactively  applied  to  airplanes  currently  certificated  for  flight  in  icing  conditions.  The  Safety 
Board  is  concerned  that  if  the  FAA  does  not  retroactively  apply  the  revised  icing  certification 
standards  and  methods  of  compliance  to  airplanes  currently  certificated  for  flight  in  icing 
conditions,  flight  handling/controllability  anomalies  that  have  not  been  accounted  for  may  remain 
unaccounted  for  until  after  a  fatal  accident,  as  occurred  in  the  ATR-72  accident  at  Roselawn  and 
the  EMB-120  accident  at  Monroe,  Michigan.  The  Safety  Board  concludes  that  the  potential 
consequences  of  operating  an  airplane  in  icing  conditions  without  first  having  thoroughly 
demonstrated  adequate  handling/controllability  characteristics  in  those  conditions  are  sufficiently 
severe  that  they  warrant  as  thorough  a  certification  test  program  as  possible,  including  application 
of  revised  standards  to  airplanes  currently  certificated  for  flight  in  icing  conditions 


Therefore,  the  Safety  Board  believes  that  the  FAA  should,  when  the  revised  icing 
certification  standards  and  criteria  are  complete,  review  the  icing  certification  of  all 
turbopropeller-driven  airplanes  that  are  currently  certificated  for  operation  in  icing  conditions  and 
perform  additional  testing  and  take  action  as  required  to  ensure  that  these  airplanes  fulfill  the 
requirements  of  the  revised  icing  certification  standards.  Further,  pending  the  accomplishment  of 
these  actions,  the  Safety  Board  believes  that  the  FAA  should  review  turbopropeller-driven 
airplane  manufacturers’  AFMs  and  air  carrier  flightcrew  operating  manuals  (where  applicable)  to 
ensure  that  these  manuals  provide  operational  procedures  for  flight  in  icing  conditions,  including 
the  activation  of  leading  edge  deicing  boots,  the  use  of  increased  airspeeds,  and  disengagement  of 

autopilot  systems  before  entering  icing  conditions  (that  is,  when  other  anti-icing  systems  have 
traditionally  been  activated). 


FAA  Policies  for  Airplane  Flight  Manuals  and  Air  Carrier  Operating  Manual  Revisions 

Because  FAA  Order  8400.10,  “Air  Transportation  Operations  Inspector’s  Handbook,” 
only  requires  operators  to  maintain  a  flight  manual  that  complies  with  existing  regulations 
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and  “safe  operating  procedures,”  Comair  was  not  required  to  incorporate  manufacturer- 
recommended  procedures  or  revisions.  In  addition  to  the  air  carrier’s  decision  not  to  incorporate 
the  procedures  contained  in  Embraer’s  EMB-120  AFM  revision  43  into  its  own  FSM,  Comair 
also  had  not  incorporated  Embraer’s  long-standing  procedures  for  the  use  of  engine  ignition  and 
inlet  deice  boots  in  icing  conditions.  Because  this  investigation  revealed  several  instances  in 
which  Comair  elected  not  to  incorporate  potentially  critical  safety-of-flight  AFM  procedures  into 
its  operating  manual  and  because  the  POI  for  Comair  (although  he  had  received  a  copy  of  AFM 
revision  43  from  Embraer)  was  apparently  not  concerned  by  the  operators’  failure  to  incorporate 
such  procedures,  the  Safety  Board  became  concerned  that  the  FAA’s  procedures  for  the 
management  and  oversight  of  air  carriers’  manuals  may  not  be  adequate. 

Although  it  was  somewhat  controversial,  revision  43  had  been  reviewed  by  FAA  and  CTA 
certification  personnel  and  had  been  approved  by  these  certification  authorities  as  the  proper  way 
to  operate  the  equipment.  However,  at  the  time  of  the  accident,  Comair  and  four  of  the  other  six 
U.S.-based  EMB-120  operators  had  not  incorporated  revision  43  in  their  flightcrew  operating 
manuals.  This  was  possible,  in  part,  because  the  FAA  had  not  mandated  incorporation  of  AFM 
revision  43  into  operators’  procedures.  (Further,  the  FAA  had  not  required  Comair  to 
incorporate  AFM  guidance  advising  pilots  to  increase  approach  airspeeds  by  5  to  10  knots  when 
operating  in  icing  conditions.)  In  its  October  1997  memo,  the  FAA  stated  that  it  would  only  issue 
an  AD  to  mandate  an  AFM  revision  when  it  considered  the  change  “significant  enough  to  warrant 
retroactive  application  to  all  aircraft.”  No  AD  was  issued  when  revision  43  to  the  EMB-120 
AFM  was  approved;  therefore,  the  FAA  apparently  did  not  consider  the  procedural  changes 
contained  in  AFM  revision  43  “significant  enough”  to  require  air  carriers’  compliance.  Further, 
existing  FAA  policy  does  not  require  interaction  or  dialog  between  FAA  flight  standards  and  air 
carrier  personnel  regarding  AFM  procedures  or  revisions.  Because  Comair  had  not  adopted  the 
AFM  revision  43  procedures,  the  pilots  of  flight  3272  were  (unknowingly)  operating  in  icing 
conditions  without  the  most  current,  safest  icing-related  guidance.  Had  Comair  incorporated 
AFM  revision  43  into  its  EMB-120  operating  procedures,  the  flightcrew  might  have  activated  the 
deicing  boots  before  the  loss  of  control  of  the  airplane,  possibly  precluding  the  accident. 
Therefore,  the  Safety  Board  concludes  that  the  current  FAA  policy  allowing  air  carriers  to  elect 
not  to  adopt  AFM  operational  procedures  without  clear  written  justification  can  result  in  air 
carriers  using  procedures  that  may  not  reflect  the  safest  operating  practices.  The  Safety  Board 
believes  that  the  FAA  should  require  air  carriers  to  adopt  the  operating  procedures  contained  in 
the  manufacturer’s  AFM  and  subsequent  approved  revisions  or  provide  written  justification  that 
an  equivalent  safety  level  results  from  an  alternative  procedure. 

Based  on  the  history  of  revision  43  and  the  need  for  the  FAA  to  more  closely  review  and 
approve  air  carrier  compliance  with  AFM  procedures,  the  Safety  Board  assessed  the  capacity  of 
the  FAA  flight  standards  organization  to  perform  such  an  enhanced  function.  The  Safety  Board 
considers  the  FAA’s  current  system  inadequate  because  it  allows  for  less  than  thorough  review 
and  communication  regarding  safety-of-flight  data/information  in  a  number  of  areas 
(i.e.,  certification,  icing  certification,  continuing  airworthiness/oversight).  Before  the  Comair 
accident,  the  FAA  POI  who  was  responsible  for  oversight  of  Comair  was  not  aware  of  the 
background  information  justifying  revision  43  to  the  EMB-120  AFM  and  thus  did  not  pursue 
corresponding  procedural  changes  with  Comair.  According  to  a  memo  received  by  the  Safety 
Board  in  October  1997  from  FAA  personnel  (the  Acting  Director  of  Flight  Standards  Service 
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and  the  Director  of  Aircraft  Certification  Service),  at  the  time  of  the  accident,  there  was  no 
procedure  to  ensure  that  information  (including  AFM  changes)  not  mandated  by  an  AD  was 
shared  between  ACO  and/or  AEG  personnel  and  other  Flight  Standards  personnel  (specifically, 
the  POIs).  The  memo  stated  that  although  informal  communications  (described  by  FAA 
personnel  as  “discretionary”)  can  occur  in  some  cases  between  ACO  and/or  AEG  personnel  and 
POIs,  there  was  no  formal  procedure  to  ensure  that  the  necessary  communication  and 
coordination  take  place.  (The  memo  further  stated  that  the  airplane  operators  “typically  supply 
that  revision  to  the  POI  ”) 

According  to  the  authors  of  the  memo,  when  the  FAA  receives  an  AFM  revision  from  a 
manufacturer,  the  ACO  personnel  would  not  engage  in  discussions  with  Flight  Standards 
personnel  unless  they  believed  that  the  AFM  revision  was  particularly  noteworthy,  in  which  case 
they  would  discuss  it  with  flight  standards  AEG  personnel.  Further,  there  was  no  explicit  line  of 
communication  between  the  AEG  and  POIs.  Thus,  under  the  current  system,  the  POI  (or  other 
pertinent  flight  standards  personnel)  might  never  know  about  the  revision  (if  ACO  personnel 
deemed  it  unnoteworthy)  unless  they  receive  a  copy  from  the  manufacturer  (as  was  the  case  with 
Embraer’s  AFM  revision  43)  or  unless  an  operator  requests  approval  for  an  associated  change  to 
its  flightcrew  operating  manual. 

The  Safety  Board  has  observed  similar  communication/coordination  problems  between 
FAA  offices  during  other  investigations — specifically,  during  the  investigation  of  the  1987  CASA 
C-212-CC  accident  at  Romulus,  Michigan,  and  the  1994  ATR-72  accident  at  Roselawn.  As  a 
result  of  the  ATR-72  accident,  the  Safety  Board  recommended  (in  Safety  Recommendation  A-96- 
62)  that  the  FAA  develop  an  organizational  structure  and  communications  system  to  ensure  that 
accident/incident  information  is  disseminated  to  ensure  effective  continuing  airworthiness 
oversight,  with  specific  emphasis  on  the  AEG.  In  April  1997,  the  FAA  agreed  that  it  would 
review  its  then-current  organizational  structure  and  processes  to  determine  the  adequacy  of  the 
communications  and  monitoring  of  the  continuing  airworthiness  of  aircraft,  and  the  Safety  Board 
classified  the  recommendation  “Open— Acceptable  Response.”  On  February  25,  1998,  the  FAA 
responded  that  it  had  initiated  positive  improvements.  Based  on  this  action  and  the  Board’s 
continuing  dialogue  with  the  FAA  on  this  issue,  Safety  Recommendation  A-96-62  remains 
classified  “Open — Acceptable  Response.” 

During  a  June  11,  1998,  meeting,  FAA  management  personnel  advised  Safety  Board  staff 
that  the  FAA  had  completed  the  review  of  its  internal  communications  procedures  and  had 
identified  areas  in  which  improvements  were  warranted.  The  Director  of  Aircraft  Certification 
Services  stated  that  the  FAA  is  “committed  to  making  changes,  [and  is]  putting  a  team  together” 
to  establish  new  procedures  to  ensure  that  information  is  shared  with  all  pertinent  personnel  in  all 
branches  of  the  FAA.  He  reported  that  under  the  new  system,  the  ACO  Project  Manager  and 
Flight  Test  Manager  will  discuss  all  flight  manual  revisions  with  flight  standards  AEG  personnel, 
who  will  in  turn  discuss  the  revisions  with  the  POIs  whose  operators  are  affected;  the  discussions 
will  not  hinge  on  a  subjective  determination  of  significance,  and  a  dispute  resolution  process  will 
be  established.  The  Safety  Board  considers  these  improved  communication  procedures  to  be 
essential  under  both  the  existing  FAA  policy  in  which  air  carrier  adoption  of  AFM  procedures  is 
optional,  and  the  Safety  Board’s  proposed  policy  that  would  in  most  cases  mandate  adoption  of 
these  procedures.  Under  the  proposed  policy,  flight  standards  and  ACO  personnel  would  need 
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to  coordinate  the  evaluation  of  AFM  revisions  and  the  equivalence  of  alternatives  proposed  by  the 
air  carriers. 

Thus,  the  Safety  Board  concludes  that  at  the  time  of  the  Comair  flight  3272  accident, 
pertinent  flight  standards  personnel  (specifically,  the  POI  assigned  to  Comair)  lacked  information 
critical  to  the  continued  safe  operation  of  the  EMB-120  fleet  and  would  have  been  unable  to 
evaluate  the  need  to  incorporate  AFM  revision  43  or  any  alternatives  proposed  by  air  carriers. 
Therefore,  the  Safety  Board  believes  that  the  FAA  should  ensure  that  flight  standards  personnel  at 
all  levels  (from  AEGs  to  certificate  management  offices)  are  informed  about  all  manufacturer  OBs 
and  AFM  revisions,  including  the  background  and  justification  for  the  revision. 


Westair  EMB-120  FDR  Sensor  Information 

The  Safety  Board  has  observed  anomalous  FDR-recorded  values  for  flight  control 
parameters  on  seven  of  eight  Embraer  EMB-120  FDRs  it  has  reviewed,  including  the  FDRs  from 
the  Comair  and  the  Westair  airplanes.  The  Westair  incident  occurred  after  the  FAA  established 
new  FDR  inspection/potentiometer  calibration  requirements  for  operators  of  EMB-120  airplanes, 
and  Westair’ s  maintenance  records  indicated  that  an  FDR  system  check  was  conducted  on  the 
incident  airplane  on  December  27,  1997,  with  no  system  discrepancies  noted.  The  test  procedure 
was  conducted  with  the  airplane  stationary  and  the  engines  not  running;  there  was  no  requirement 
for  an  FDR  readout  during  the  test  procedure. 

Although  there  were  no  sensor  discrepancies  noted  during  the  Westair  FDR  system  check, 
the  Safety  Board’s  postincident  review  of  the  incident  airplane’s  FDR  data  revealed  discrepancies 
in  the  control  wheel  and  rudder  pedal  position  parameters.  The  Safety  Board’s  evaluation  of  the 
potentiometer  calibration  test  criteria  and  the  symptoms  displayed  by  the  problem  sensors 
indicated  that  the  sensor  anomalies  may  not  have  been  detectable  during  static  tests  on  the 
ground.  The  test  procedure  did  not  provide  an  evaluation  of  sensor  performance  under  normal 
operating  conditions  and,  therefore,  may  be  of  limited  use  in  detecting  noisy  signals  or  invalid 
signals  that  are  confined  to  only  a  portion  of  the  sensor’s  normal  operating  range.  The  Safety 
Board  considers  it  likely  that  if  an  FDR  readout  had  been  conducted  and  pertinent  parameters 
reviewed  in  conjunction  with  the  FDR  system  check,  the  control  wheel  position  and  rudder  sensor 
anomalies  would  have  been  observed,  and  efforts  would  have  been  taken  to  correct  them. 

Reliable  FDR  information  is  critical  to  understanding  accident/incident  scenarios  and 
invaluable  in  identifying  complex  safety  issues  and  solutions;  when  FDR  information  is  not 
recorded  (or  is  recorded  incorrectly)  for  any  given  parameter,  it  becomes  more  likely  that 
potentially  significant  safety  issues  will  not  be  identified.  Further  (as  noted  in  the  Safety  Board’s 
report  regarding  the  August  1997  accident  involving  a  Fine  Airlines  Douglas  DC-8-61  at  Miami, 
Florida),27  reliable  FDR  data,  read  out  at  regular  inspection  intervals,  can  be  useful  for  purposes 
other  than  accident/incident  investigation.  Analysis  of  such  FDR  data  could  be  used  by  operators 
to  monitor  trends  and  efficiency  in  their  flight  operations  through  a  flight  operations  quality 


27  See  National  Transportation  Safety  Board.  1998.  Fine  Airlines  Flight  101,  Douglas  DC-8-61,  N27UA, 
Miami,  Florida ,  August  7,  1997.  Aircraft  Accident  Report  NTSB/ AAR-98/02.  Washington,  DC. 
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assurance  program  and  could  be  used  on  an  industry-wide  basis  to  streamline  flight  operations, 
refine  ATC  procedures  and  airport  configurations,  and  improve  aircraft  designs. 


The  Safety  Board  concludes  that  the  FAA’s  current  EMB-120  FDR  system  inspection 
procedure  is  inadequate  because  it  allows  existing  flight  control  sensor  anomalies  to  go 
undetected,  and  thus  unconrected.  Therefore,  the  Safety  Board  believes  that  the  FAA  should 
revise  its  current  EMB-120  FDR  system  inspection  procedure  to  include  an  FDR  readout  and 
evaluation  of  parameter  values  from  normal  operations  to  ensure  a  more  accurate  assessment  of 
the  operating  status  of  the  flight  control  position  sensors  on  board  the  airplane. 

The  Lack  of  Additional  Icing-Related  Pilot  Reports 

The  Safety  Board’s  investigation  of  the  meteorological  aspects  of  this  accident  revealed 
that  about  16  icing-related  pilot  reports  (PIREPs)  were  issued  by  pilots  operating  in  the 
northwestern  Ohio/southem  Michigan  area  between  1300  and  1700  on  the  day  of  the  accident. 
However,  when  the  Safety  Board  distributed  a  weather  conditions  survey  to  additional  flightcrews 
that  were  operating  near  Detroit  about  the  time  of  the  accident,  9  of  the  1 1  pilots  who  responded 
to  the  survey  reported  that  they  encountered  icing  conditions.  Of  the  nine  pilots  who  indicated 
that  they  encountered  icing  conditions,  only  one  pilot  had  submitted  a  pilot  report  for  the 
conditions  they  observed  on  the  day  of  the  accident.  (In  response  to  a  survey  question  that  asked 
if  they  submitted  a  PIREP,  two  pilots  stated  that  they  did  not  submit  a  PIREP  because  the 
conditions  encountered  were  consistent  with  the  forecast  icing  conditions;  one  pilot  reported  that 
he  did  not  submit  a  PIREP  because  of  accident-related  congestion  on  the  ATC  frequency;  and  the 
pilots  of  another  airplane  reported  that  they  were  too  busy  during  the  approach,  landing,  and  taxi 

to  submit  a  PIREP.  The  survey  responses  from  the  other  four  responding  pilots  did  not  state  whv 
they  did  not  submit  PIREPs.)  J 

Although  the  Safety  Board  does  not  believe  that  the  absence  of  these  additional  PIREPs 
affected  the  accident  flightcrew’s  actions  (because  they  were  provided  with  adequate  preflight  en 
route,  and  arrival  weather  information  to  conduct  the  flight  safely;  they  should  have  been  aware 
that  they  would  be  operating  in  potential  icing  conditions),  it  is  possible  that  the  PIREP 
information  would  have  greatly  benefited  other  pilots.  Because  PIREPs  are  an  important  and 
valuable  source  of  weather  information  for  pilots,  the  Safety  Board  is  concerned  that  pilots  had 
observed  icing  in  the  Detroit  area  the  day  of  the  accident  but  did  not  share  that  information  with 
other  pilots.  Thus,  the  Safety  Board  concludes  that  the  failure  of  pilots  who  encounter  in-flight 
icing  to  report  the  information  to  the  appropriate  facility  denies  other  pilots  operating  in  the  area 
the  access  to  valuable  and  timely  information  that  could  prevent  an  accident.  Therefore  the 
Safety  Board  believes  that  the  FAA  should  reemphasize  to  pilots,  on  a  periodic  basis,  their 
responsibility  to  report  meteorological  conditions  that  may  adversely  affect  the  safety  of  other 
lghts,  such  as  in-flight  icing  and  turbulence,  to  the  appropriate  facility  as  soon  as  practicable. 

Also,  because  a  Detroit  air  traffic  controller  did  not  disseminate  icing-related  information 
that  he  had  received  from  another  flight  operating  in  the  area  about  20  minutes  before  the 
accident,  the  Safety  Board  examined  the  dissemination  of  icing-related  information  through  the 
ATC  system.  The  Board  notes  that  the  Standard  Operating  Procedures  handbook  for  DTW  Air 
Traffic  Control  Tower  and  Terminal  Radar  Approach  Control  did  not  require  that  icing 
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reports  be  included  on  the  automatic  terminal  information  service  (ATIS)  recording  that  is 
monitored  by  all  pilots.  Although  FAA  Order  71 10.65,  “Air  Traffic  Control,”  contains  guidance 
that  PIREPs  of  any  type  should  be  included  in  the  ATIS  broadcast  “as  appropriate”  and  “pertinent 
to  operations  in  the  terminal  area,”  this  guidance  is  too  broad  and  subjective  to  adequately  ensure 
the  transmission  of  icing-related  information  in  an  airport  terminal  environment.  Reports  of  icing 
conditions  should  be  of  interest  to  all  pilots  operating  within  that  environment,  especially 
considering  the  normally  reduced  airspeeds  and  decreased  stall  margins  for  airplanes  operating  in 
the  approach  and  departure  phases  of  flight.  Therefore,  the  Safety  Board  concludes  that  the  FAA 
ATC  system  has  not  established  adequate  procedures  for  the  dissemination  of  icing-related  pilot 
reports  received  in  the  airport  terminal  environment;  these  reports  should  be  incorporated  into 
ATIS  broadcasts  so  that  all  arriving  and  departing  pilots  can  become  aware  of  icing  conditions  in 
the  area.  Consequently,  the  Safety  Board  believes  that  the  FAA  should  amend  FAA  Order 
7110.65,  “Air  Traffic  Control,”  to  require  that  ATIS  broadcasts  include  information  regarding  the 
existence  of  pilot  reports  of  icing  conditions  in  that  airport  terminal’s  environment  (and  adjacent 
airport  terminal  environments  as  meteorologically  pertinent  and  operationally  feasible)  as  soon  as 
practicable  after  receipt  of  the  pilot  report. 

Therefore,  the  National  Transportation  Safety  Board  makes  the  following 
recommendations  to  the  Federal  Aviation  Administration: 

Amend  the  definition  of  trace  ice  contained  in  Federal  Aviation  Administration  (FAA) 
Order  7110.10L,  “Flight  Services,”  (and  in  other  FAA  documents  as  applicable)  so 
that  it  does  not  indicate  that  trace  icing  is  not  hazardous.  (A-98-88) 

Require  principal  operations  inspectors  (POIs)  to  discuss  the  information  contained  in 
airplane  flight  manual  revisions  and/or  manufacturers’  operational  bulletins  with 
affected  air  carrier  operators  and,  if  the  POI  determines  that  the  information  contained 
in  those  publications  is  important  information  for  flight  operations,  to  encourage  the 
affected  air  carrier  operators  to  share  that  information  with  the  pilots  who  are 
operating  those  airplanes.  (A-98-89) 

With  the  National  Aeronautics  and  Space  Administration  and  other  interested  aviation 
organizations,  organize  and  implement  an  industry-wide  training  effort  to  educate 
manufacturers,  operators,  and  pilots  of  air  carrier  and  general  aviation  tuibopropeller- 
driven  airplanes  regarding  the  hazards  of  thin,  possibly  imperceptible,  rough  ice 
accumulations,  the  importance  of  activating  the  leading  edge  deicing  boots  as  soon  as 
the  airplane  enters  icing  conditions  (for  those  airplanes  in  which  ice  bridging  is  not  a 
concern),  and  the  importance  of  maintaining  minimum  airspeeds  in  icing  conditions. 
(A-98-90) 

Require  manufacturers  and  operators  of  modem  turbopropeller-driven  airplanes  in 
which  ice  bridging  is  not  a  concern  to  review  and  revise  the  guidance  contained  in  their 
manuals  and  training  programs  to  include  updated  icing  information  and  to  emphasize 
that  leading  edge  deicing  boots  should  be  activated  as  soon  as  the  airplane  enters  icing 
conditions.  (A-98-91) 
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With  the  National  Aeronautics  and  Space  Administration  and  other  interested  aviation 
organizations,  conduct  additional  research  to  identify  realistic  ice  accumulations,  to 
include  intercycle  and  residual  ice  accumulations  and  ice  accumulations  on  unprotected 
surfaces  aft  of  the  deicing  boots,  and  to  determine  the  effects  and  criticality  of  such  ice 
accumulations;  further,  the  information  developed  through  such  research  should  be 
incorporated  into  aircraft  certification  requirements  and  pilot  training  programs  at  all 
levels.  (A-98-92) 

Actively  pursue  research  with  airframe  manufacturers  and  other  industry  personnel  to 
develop  effective  ice  detection/protection  systems  that  will  keep  critical  airplane 
surfaces  free  of  ice;  then  require  their  installation  on  newly  manufactured  and  in- 
service  airplanes  certificated  for  flight  in  icing  conditions.  (A-98-93) 

Require  manufacturers  of  all  turbine-engine  driven  airplanes  (including  the  EMB-120) 
to  provide  minimum  maneuvering  airspeed  information  for  all  airplane  configurations, 
phases,  and  conditions  of  flight  (icing  and  nonicing  conditions);  minimum  airspeeds 
also  should  take  into  consideration  the  effects  of  various  types,  amounts,  and  locations 
of  ice  accumulation,  including  thin  amounts  of  very  rough  ice,  ice  accumulated  in 
supercooled  large  droplet  icing  conditions,  and  tailplane  icing.  (A-98-94) 

Require  the  operators  of  all  turbine-engine  driven  airplanes  (including  the  EMB-120) 
to  incorporate  the  manufacturer’s  minimum  maneuvering  airspeeds  for  various  airplane 
configurations  and  phases  and  conditions  of  flight  in  their  operating  manuals  and  pilot 
training  programs  in  a  clear  and  concise  manner,  with  emphasis  on  maintaining 
minimum  safe  airspeeds  while  operating  in  icing  conditions.  (A-98-95) 

Require  the  manufacturers  and  operators  of  all  airplanes  that  are  certificated  to  operate 
in  icing  conditions  to  install  stall  warning/protection  systems  that  provide  a  cockpit 
warning  (aural  warning  and/or  stick  shaker)  before  the  onset  of  stall  when  the  airplane 
is  operating  in  icing  conditions.  (A-98-96) 

Require  all  operators  of  turbopropeller-driven  air  carrier  airplanes  to  require  pilots  to 
disengage  the  autopilot  and  fly  the  airplane  manually  when  they  activate  the  anti-ice 
systems.  (A-98-97) 


Require  all  manufacturers  of  transport-category  airplanes  to  incorporate  logic  into  all 
new  and  existing  transport-category  airplanes  that  have  autopilots  installed  to  provide 
a  cockpit  aural  warning  to  alert  pilots  when  the  airplane’s  bank  and/or  pitch  exceeds 
the  autopilot’s  maximum  bank  and/or  pitch  command  limits.  (A-98-98) 

Expedite  the  research,  development,  and  implementation  of  revisions  to  the  icing 
certification  testing  regulations  to  ensure  that  airplanes  are  adequately  tested  for  the 
conditions  in  which  they  are  certificated  to  operate;  the  research  should  include 
identification  (and  incorporation  into  icing  certification  requirements)  of  realistic  ice 
shapes  and  their  effects  and  criticality.  (A-98-99) 
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When  the  revised  icing  certification  standards  and  criteria  are  complete,  review  the 
icing  certification  of  all  turbopropeller-driven  airplanes  that  are  currently  certificated 
for  operation  in  icing  conditions  and  perform  additional  testing  and  take  action  as 
required  to  ensure  that  these  airplanes  fulfill  the  requirements  of  the  revised  icing 
certification  standards.  (A-98-100) 

Review  turbopropeller-driven  airplane  manufacturers’  airplane  flight  manuals  and  air 
carrier  flightcrew  operating  manuals  (where  applicable)  to  ensure  that  these  manuals 
provide  operational  procedures  for  flight  in  icing  conditions,  including  the  activation  of 
leading  edge  deicing  boots,  the  use  of  increased  airspeeds,  and  disengagement  of 
autopilot  systems  before  entering  icing  conditions  (that  is,  when  other  anti-icing 
systems  have  traditionally  been  activated).  (A-98-101) 

Require  air  carriers  to  adopt  the  operating  procedures  contained  in  the  manufacturer’s 
airplane  flight  manual  and  subsequent  approved  revisions  or  provide  written 
justification  that  an  equivalent  safety  level  results  from  an  alternative  procedure. 
(A-98-102) 

Ensure  that  flight  standards  personnel  at  all  levels  (from  aircraft  evaluation  groups  to 
certificate  management  offices)  are  informed  about  all  manufacturer  operational 
bulletins  and  airplane  flight  manual  revisions,  including  the  background  and 
justification  for  the  revision.  (A-98-103) 

Revise  its  current  EMB-120  flight  data  recorder  (FDR)  system  inspection  procedure 
to  include  a  FDR  readout  and  evaluation  of  parameter  values  from  normal  operations 
to  ensure  a  more  accurate  assessment  of  the  operating  status  of  the  flight  control 
position  sensors  on  board  the  airplane.  (A-98-104) 

Reemphasize  to  pilots,  on  a  periodic  basis,  their  responsibility  to  report  meteorological 
conditions  that  may  adversely  affect  the  safety  of  other  flights,  such  as  in-flight  icing 
and  turbulence,  to  the  appropriate  facility  as  soon  as  practicable.  (A-98-105) 

Amend  Federal  Aviation  Administration  Order  7110.65,  “Air  Traffic  Control,”  to 
require  that  automatic  terminal  information  service  broadcasts  include  information 
regarding  the  existence  of  pilot  reports  of  icing  conditions  in  that  airport  terminal’s 
environment  (and  adjacent  airport  terminal  environments  as  meteorologically  pertinent 
and  operationally  feasible)  as  soon  as  practicable  after  receipt  of  the  pilot  report.  (A- 
98-106) 

In  addition,  the  Safety  Board  reiterates  the  following  safety  recommendations  to  the 
Federal  Aviation  Administration: 

Revise  the  icing  criteria  published  in  14  Code  of  Federal  Regulations  Parts  23  and  25, 
in  light  of  both  recent  research  into  aircraft  ice  accretion  under  varying  conditions  of 
liquid  water  content,  drop  size  distribution,  and  temperature,  and  recent  development 
in  both  the  design  and  use  of  aircraft.  Also,  expand  the  Part  25  appendix  C  icing 
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certification  envelope  to  include  freezing  drizzle/freezing  rain  and  mixed  water/ice 
crystal  conditions,  as  necessary.  (A-96-54) 

Revise  the  icing  certification  testing  regulation  to  ensure  that  airplanes  are  properly 
tested  for  all  conditions  in  which  they  are  authorized  to  operate,  or  are  otherwise 
shown  to  be  capable  of  safe  flight  into  such  conditions.  If  safe  operations  cannot  be 
demonstrated  by  the  manufacturer,  operational  limitations  should  be  imposed  to 
prohibit  flight  in  such  conditions  and  flightcrews  should  be  provided  with  the  means  to 
positively  determine  when  they  are  in  icing  conditions  that  exceed  the  limits  for  aircraft 
certification.  (A-96-56) 

Chairman  HALL,  Vice  Chairman  FRANCIS,**  and  Members  HAMMERSCHMIDT, 
GOGLIA,  and  BLACK  concurred  in  these  recommendations. 


**Vice  Chairman  Francis  did  not  participate 
Safety  Recommendations  A-96-54  and  A-96-56. 


in 


the  vote  to  reiterate 


National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  November  30,  1998 

In  reply  refer  to:  A-98-107  to  -108 


Honorable  Daniel  S.  Goldin 
Administrator 

National  Aeronautics  and  Space  Administration 
Washington,  D.C.  20546 


About  1554  eastern  standard  time,1  on  January  9,  1997,  an  Empresa  Brasileira  de 
Aeronautica,  S/A  (Embraer)  EMB-120RT,  N265CA,  operated  by  COMAIR  Airlines,  Inc.,2  as 
flight  3272,  crashed  during  a  rapid  descent  after  an  uncommanded  roll  excursion  near  Monroe, 
Michigan.  Comair  flight  3272  was  being  operated  under  the  provisions  of  Tide  14  Code  of 
Federal  Regulations  (CFR)  Part  135  as  a  scheduled,  domestic  passenger  flight  from  the 
Cincinnati/Northem  Kentucky  International  Airport  (CVG),  Covington,  Kentucky,  to  Detroit 
Metropolitan/Wayne  County  Airport  (DTW),  Detroit,  Michigan.  The  flight  departed  CVG  about 
1508,  with  2  flightcrew  members,  1  flight  attendant,  and  26  passengers  on  board.  There  were  no 
survivors.  The  airplane  was  destroyed  by  ground  impact  forces  and  a  postaccident  fire. 
Instrument  meteorological  conditions  prevailed  at  the  time  of  the  accident,  and  flight  3272  was 
operating  on  an  instrument  flight  rules  flight  plan. 

The  National  Transportation  Safety  Board  determined  that  the  probable  cause  of  this 
accident  was  the  Federal  Aviation  Administration’s  (FAA)  failure  to  establish  adequate  aircraft 
certification  standards  for  flight  in  icing  conditions,  the  FAA’s  failure  to  ensure  that  a  Centro 
Tecnico  Aeroespacial/FAA-approved  procedure  for  the  accident  airplane’s  deice  system  operation 
was  implemented  by  U.S.-based  air  carriers,  and  the  FAA’s  failure  to  require  the  establishment  of 
adequate  minimum  airspeeds  for  icing  conditions,  which  led  to  the  loss  of 
control  when  the  airplane  accumulated  a  thin,  rough  accretion  of  ice  on  its  lifting  surfaces.3 


1  Unless  otherwise  indicated,  all  times  are  eastern  standard  time,  based  on  a  24-hour  clock. 

2  Within  this  safety  recommendation  letter,  COMAIR  Airlines,  Inc.,  will  be  identified  as  Comair. 

3  National  Transportation  Safety  Board.  1998.  In-Flight  Icing  Encounter  and  Uncontrolled  Collision 
With  Terrain,  Comair  Flight  3272,  Embraer  EMB-I20RT,  N265CA,  Monroe,  Michigan,  January  9,  1997.  Aircraft 
Accident  Report  NTSB/AAR-98/04.  Washington,  DC. 
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Summary  of  Accident  Sequence 

According  to  cockpit  voice  recorder  (CVR)  and  air  traffic  control  (ATC)  information, 
during  the  20  minutes  preceding  the  accident,  the  pilots  received  a  series  of  clearances  from  ATC 
that  included  descent,  airspeed,  and  heading  instructions.  Flight  data  recorder  (FDR)  and  radar 
data  indicated  that  the  airplane’s  descent  from  the  en  route  cruise  altitude  of  flight  level  210  to 
4,000  feet  mean  sea  level  (msl)  was  stable  and  controlled  and  was  accomplished  at  airspeeds  and 
headings  consistent  with  those  assigned  by  ATC.  Meteorological  information  and  pilot  reports 
indicated  that  the  airplane  was  probably  intermittently  in  clouds  as  it  descended  between  about 
1 1,000  feet  msl  and  8,200  feet  msl;  below  8,200  feet  msl,  the  airplane  was  probably  operating 
predominantly  in  the  clouds. 

The  pilots  were  operating  with  the  autopilot  engaged  during  the  descent.  They  had 
completed  the  descent  checklist  (including  the  activation  of  the  propeller  deicing  and  windshield 
heat  at  the  ice  protection  checklist  prompt)  and  the  first  four  of  the  six  items  on  the  approach 
checklist4  before  the  airplane  reached  4,000  feet  msl  during  its  descent.  At  1553:59,  when  the 
autopilot  was  leveling  the  airplane  at  4,000  feet  msl  on  a  heading  of  180°,  the  airplane  was  in  the 
clean  configuration  (no  flaps  or  gear  extended)  at  an  airspeed  of  about  166  knots  (the  pilots  were 
beginning  to  reduce  the  airspeed  to  the  ATC-assigned  airspeed  of  150  knots).  At  that  time,  ATC 
instructed  the  pilots  of  flight  3272  to  turn  left  to  a  heading  of  090°.  Shortly  after  the  pilots 
initiated  the  left  turn  (by  selecting  the  assigned  heading  for  the  autopilot),  the  airplane  reached  its 
selected  altitude  and  (at  1554:08)  the  autopilot  automatically  transitioned  to  the  altitude  hold 
mode.  As  the  autopilot  attempted  to  maintain  the  selected  altitude,  the  airplane’s  angle-of-attack 
(AO A)  began  to  increase  and  the  airspeed  continued  to  decrease;  at  1554:10,  the  autopilot  began 
to  trim  the  elevator  (pitch  trim)  to  an  increasingly  nose-up  position. 

The  accident  airplane’s  FDR  data  indicated  that  at  1554:10  the  airplane’s  left  bank 
steepened  beyond  20°  (moving  toward  the  autopilot’s  command  limit  in  the  heading  mode  of  25°, 
+/-  2.5°).  At  that  point  (according  to  the  autopilot  design  and  FDR  information),  the  roll  rate 
exceeded  that  required  by  the  autopilot’s  design  logic  to  achieve  the  commanded  roll  angle,  and 
the  autopilot’s  input  to  the  aileron  servos  moved  the  ailerons  (and  thus  the  airplane’s  control 
wheel)  in  the  right-wing-down  direction  to  counter  the  increasing  left  roll  rate.  FDR  data 
indicated  that,  during  the  next  3  seconds,  the  left  and  right  AOA  vanes  began  to  diverge, 
indicating  a  left  sideslip/yaw  condition,  and  the  lateral  acceleration  values  began  to  increase  to  the 
left  while  the  autopilot  increased  the  control  wheel  input  to  the  right  in  an  attempt  to  control  the 
roll.  Thus,  by  1554:10,  as  the  airspeed  decreased  through  155  knots,  the  airplane  experienced  the 
beginning  of  a  significant  asymmetry  in  the  lift  distribution  between  the  right  and  left  wings  and  an 
uncommanded  yaw  and  roll  to  the  left.5  The  roll  and  control  wheel  position  parameters  continued 


4  According  to  several  Comair  EMB-120  pilots,  the  remaining  approach  checklist  items — flight 
attendants,  notified  and  flaps,  15/15/checked — would  normally  be  accomplished  later  during  the  approach,  as  the 
airplane  neared  the  destination  airport. 

5  Evaluation  of  the  FDR  information  revealed  that  a  slight  asymmetry  of  lift  because  of  ice  existed  earlier 
in  the  flight;  however,  it  became  aerodynamically  significant  about  1554:10. 
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to  trend  in  opposite  directions,  and  the  left  and  right  AOA  vanes  continued  to  split  for  the  next  14 
seconds,  until  the  autopilot  disconnected  at  1554:24. 125. 

Just  after  1554:15,  as  the  airplane’s  airspeed  began  to  decrease  below  150  knots,  the 
pilots  began  to  increase  the  engine  power;6  however,  the  airplane’s  airspeed  continued  to 
decrease.  When  the  captain  drew  the  first  officer’s  attention  to  the  low  airspeed  indication  at 
1554:20.8,  the  airplane’s  airspeed  had  decreased  to  147  knots.  During  the  next  2  seconds,  the 
pilots  more  aggressively  increased  the  engine  power,  and  a  significant  torque  split  occurred;  the 
torque  values  peaked  at  108  percent  on  the  left  engine  and  138  percent  on  the  right  engine.  The 
Safety  Board  considered  several  possible  reasons  for  the  significant  torque  split,  including  uneven 
throttle  movement  by  the  pilots,  ice  ingestion  by  the  left  engine,  a  misrigged  engine,  or  an 
improper  engine  trim  adjustment  on  the  newly  installed  right  engine;  however,  it  was  not  possible 
to  positively  determine  the  cause  of  the  torque  split.  Postaccident  simulations  indicated  that  this 
torque  split  had  a  significant  yaw-producing  effect  at  a  critical  time  in  the  upset  event, 
exacerbating  the  airplane’s  excessive  left  roll  tendency.  The  airplane’s  airspeed  decreased  further 
to  146  knots,  the  left  roll  angle  increased  beyond  the  autopilot’s  45°  limit,  and  (at  1554:24.1)  the 
autopilot  disconnect  warning  began  to  sound.  One  second  later,  the  stick  shaker  activated.  The 
sudden  disengagement  of  the  autopilot  (at  1554:24.125)  greatly  accelerated  the  left  rolling 
moment  that  had  been  developing,  suddenly  putting  the  airplane  in  an  unusual  attitude.  Although 
the  pilots  were  likely  surprised  by  the  upset  event,  interpretation  of  the  FDR  data  indicated  that 
the  pilots  responded  with  control  wheel  inputs  to  counter  the  left  roll  within  1  second  of  the 
autopilot  disengagement  and  continued  to  apply  control  inputs  in  an  apparent  attempt  to  regain 
control  of  the  airplane  until  the  FDR  recording  ceased. 

Meteorological  Factors 


Although  Comair  flight  3272  was  operating  in  winter  weather  conditions  throughout  its 
flight  from  the  Cincinnati  area  to  Detroit,  CVR  and  weather  information  indicated  that  the 
airplane  was  operating  above  the  cloud  tops  at  its  cruise  altitude  of  21,000  feet  msl.  Further,  the 
temperatures  at  the  altitudes  flown  during  the  en  route  phase  of  the  flight  were  too  cold  to  be 
conducive  to  airframe  ice  accretion,  and  examination  of  the  FDR  data  did  not  reflect  degraded 
airplane  performance  until  later  in  the  airplane’s  descent.  Therefore,  the  Safety  Board  concludes 
that  the  airplane  was  aerodynamically  clean,  with  no  effective  ice  accreted,  when  it  began  its 
descent  to  the  Detroit  area. 

A  study  conducted  by  the  National  Center  for  Atmospheric  Research  (NCAR)  indicated 
that  there  was  strong  evidence  for  the  existence  of  icing  conditions  in  the  clouds  along  the 
accident  airplane  s  descent  path  below  11,000  feet  msl.  In  addition,  weather  radar  data  showed 
generally  light  precipitation  intensities  in  the  area  west  of  Detroit,  with  weather  echoes  of 
increasing  intensity  below  11,000  feet  msl  along  the  airplane’s  descent  path.  The  weather  radar 

6  An  engine  torque  split  manifested  itself  during  this  application  of  power— at  1554: 17,  the  FDR  recorded 
torque  values  of  33.3  percent  and  39.3  percent  on  the  left  and  right  engines,  respectively.  The  engine  torque  split 
ranged  from  6  to  10  percent  between  1554:17  and  1554:22,  when  torque  values  (and  the  range  of  the  torque  split) 
began  to  increase  abruptly.  Simulator  test  flights  that  replicated  the  accident  scenario  demonstrated  that  the  initial 
6  to  10  percent  torque  split  did  not  have  a  large  aerodynamic  effect  on  the  airplane’s  left  roll;  however,  the  larger 
torque  split  that  occurred  later  in  the  accident  sequence  had  a  significant  aerodynamic  effect. 
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data  indicated  that  the  highest  precipitation  intensities  likely  existed  between  4,100  feet  msl  and 
3,900  feet  msl. 

The  NCAR  research  meteorologists  reported  that  the  average  liquid  water  content  (LWC) 
in  the  clouds  near  the  accident  site  likely  varied  from  0.025  to  0.4  grams  per  cubic  meter  when 
averaged  over  the  cloud  depth.  However,  according  to  an  NCAR  research  meteorologist,  droplet 
size  and  LWC  are  rarely  evenly  distributed  through  the  depth  of  a  cloud;  he  stated  that,  in  a 
typical  cloud  distribution,  the  larger  droplet  sizes  with  corresponding  lower  LWC  would  likely 
exist  near  the  cloud  bases,  whereas  smaller  droplet  sizes  with  higher  LWC  would  typically  exist 
near  the  cloud  tops.  He  stated  that  the  accident  airplane  might  have  encountered  higher  LWC 
values  (0.5-0.8  grams  per  cubic  meter)  with  smaller  droplets  (non-supercooled  large  droplets 
(SLD),  10-30  microns)  near  the  cloud  tops  and  lower  LWC  values  (0.025  to  0.4  grams  per  cubic 
meter)  with  larger  droplets  (larger  than  30  microns)  near  the  cloud  bases  (consistent  with  the 
previously  discussed  weather  radar  data).  Further,  the  NCAR  research  meteorologist  stated,  “if 
any  SLD  existed.. .it  would  have  been  more  likely  to  be  lower  in  the  cloud. ..be  mixed  with 
smaller  drops...  the  larger  drops  in  the  spectrum  of  those  that  may  have  existed  there  would  have 
been  in  the  200-400  micron. .  .range.” 

In  addition,  the  accident  airplane’s  descent  path  passed  through  an  area  of  relatively  low 
radar  reflectivity  during  the  4  to  5  minutes  before  the  accident.  According  to  the  NCAR  report, 
the  area  of  reduced  reflectivity  indicated  that  “the  snow-making  process  was  less  efficient  there, 
thus  allowing  a  greater  opportunity  for  liquid  cloud  to  exist.”  Postaccident  statements  obtained 
from  the  other  pilots  who  were  operating  along  the  accident  airplane’s  flightpath  (and  passed 
through  the  area  of  low  reflectivity)  near  the  time  of  the  accident  indicated  that  they  encountered 
widely  variable  conditions.  For  example,  the  pilots  of  Cactus  50  reported  moderate  rime  icing 
with  the  possibility  of  freezing  drizzle,  the  pilots  of  Northwest  Airlines  (NW)  flight  272 
encountered  moderate-to-severe  rime  icing  as  soon  as  they  leveled  off  at  4,000  feet  msl,  and  the 
pilots  of  NW  flight  483  reported  no  icing. 

Comparison  of  data  from  the  airplanes  indicates  that  the  differences  in  airframe  ice 
accretion  reported  by  the  pilots  can  be  attributed  to  slight  differences  in  timing,  altitude,  location 
(ground  track),  airspeed,  and  icing  exposure  time  (and  time  within  the  area  of  reduced  reflectivity) 
of  the  airplanes.  Based  on  weather  radar  information  and  pilot  statements,  the  Safety  Board 
concludes  that  the  weather  conditions  near  the  accident  site  were  highly  variable  and  were 
conducive  to  the  formation  of  rime  or  mixed  ice  at  various  altitudes  and  in  various  amounts,  rates, 
and  types  of  accumulation;  if  SLD  icing  conditions  were  present,  the  droplet  sizes  probably  did 
not  exceed  400  microns  and  most  likely  existed  near  4,000  feet  msl. 

Aerodynamic  Effect  of  the  Ice  Accretion 

To  help  assess  the  type,  amount,  and  effect  of  the  ice  that  might  have  been  accumulated  by 
Comair  flight  3272  during  its  descent,  the  Safety  Board  reviewed  the  available  icing  and  wind 
tunnel  research  data,  conducted  additional  airplane  performance  studies/simulations,  and 
requested  the  National  Aeronautics  and  Space  Administration’s  (NASA’s)  assistance  in 
conducting  icing  research  tunnel  (IRT)  tests  and  computational  studies.  In  addition,  the  Safety 
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Board  reviewed  wind  tunnel  test  data  obtained  during  research  conducted  by  the  FAA  at  the 
University  of  Illinois  at  Urbana/Champaign  (UIUC). 

The  Safety  Board’s  study  of  the  accident  airplane’s  aerodynamic  performance  indicated 
that  it  began  to  degrade  from  ice  accumulation7  about  4'A  to  5  minutes  before  the  autopilot 
disengaged,  as  the  airplane  descended  through  7,000  feet  msl;  the  amount  of  degradation 
increased  gradually  as  the  airplane  descended  to  4,000  feet  msl.  Based  on  this  gradual 
performance  degradation,  weather  radar  data  that  showed  light  precipitation  intensities,  pilot 
reports  of  moderate  or  less  ice  accretions,8  and  the  Safety  Board  and  NCAR  weather  studies,  it 
appeared  likely  that  Comair  flight  3272  encountered  icing  conditions  that  fell  within  the  14  CFR 
Part  25  appendix  C  envelope9 10  and/or  the  lower  portion  of  the  SLD  icing  range  during  its  descent 
to  4,000  feet  msl.  Thus,  the  postaccident  icing  tunnel  tests  were  performed  using  LWCs  between 
0.52  and  0.85  grams  per  cubic  meter  and  water  droplet  sizes  between  20  microns  and 
270  microns.  Total  air  temperatures  (TAT)  used  in  the  icing  tunnel  tests  ranged  between  26°  F 
and  31  F  (-3  C  and  -0.5  C),1  consistent  with  the  static  air  temperature  (SAT)  values  recorded 
by  the  FDR  during  the  airplane’s  descent  from  7,000  to  4,000  feet  msl.  The  exposure  time  used 
in  the  icing  tunnel  tests  was  5  minutes;  additional  runs  were  conducted  under  some  test  conditions 
to  determine  the  effect  that  deicing  boot  activation  had  on  cleaning  the  leading  edge  and  on 
subsequent  ice  accretions. 

The  icing  tunnel  tests  did  not  result  in  thick  ice  accumulation  under  any  test  condition 
(including  SLD  droplets);  rather,  the  tests  consistently  resulted  in  a  thin  (0.25  inch  accumulation 
or  less),  rough  “sandpaper-type”  ice  coverage  over  a  large  portion  of  the  airfoil’s  leading  edge 
deicing  boot  surface  area  (and  aft  of  the  deicing  boot  on  the  lower  wing  surface  in  some  test 
conditions).  In  addition,  in  many  IRT  test  conditions,  small  QA  inch)  ice  ridges  accreted  along  the 
leading  edge  deicing  boot  seams.  According  to  NASA  and  Safety  Board  IRT  test  observers,  the 
thin,  rough  ice  coverages  (and  ice  ridges,  where  applicable)  that  accreted  on  the  EMB-120  wing 
were  somewhat  translucent  and  were  often  difficult  to  perceive  from  the  observation  window. 
The  IRT  observers  further  noted  that  IRT  lighting  conditions  and  cloud  (spray)  type  greatly 
affected  the  conspicuity  of  the  ice  accumulation,  rnaking  it  difficult  to  perceive  the  ice 
accumulation  during  the  icing  exposure  periods.  Scientists  at  NASA’s  Lewis  Research  Center 
described  the  IRT  ice  accretions  as  mostly  “glaze”  ice,  like  mixed  or  clear  ice  in  nature,  although 
it  looked  slightly  like  rime  ice  when  the  IRT  was  brightly  lighted  for  photographic  documentation 
of  the  ice  accretions  because  of  its  roughness.  The  Safety  Board  notes  that  it  is  possible  that  such 
an  accumulation  would  be  difficult  for  pilots  to  perceive  visually  during  flight,  particularly  in  low 


7  Although  the  Safety  Board  considered  other  possible  sources  for  the  aerodynamic  degradation  (such  as  a 
mechanical  malfunction),  the  physical  evidence  did  not  support  a  system  or  structural  failure,  and  the  FDR  data 
indicated  a  gradual,  steadily  increasing  performance  degradation  that  was  consistent  with  degradation  observed  by 
the  Safety  Board  in  data  from  events  in  which  icing  was  a  known  factor. 

8  All  pilot  reports  indicated  moderate  or  less  ice  accretions,  except  the  pilots  of  NW  flight  272,  who 
reported  that  they  encountered  a  trace  of  rime  ice  during  the  descent,  then  encountered  moderate-to-severe  icing  at 
4,000  feet  msl  about  2  minutes  after  the  accident. 

9  The  Part  25  appendix  C  icing  envelope  specifies  the  water  drop  mean  effective  diameter,  the  LWC,  and 
the  temperatures  at  which  the  airplane  must  be  able  to  safely  operate;  aircraft  compliance  must  be  demonstrated 
through  analysis,  experimentation,  and  flight  testing. 

10  These  TATs  are  equivalent  to  SATs  of  21°  F  (-6°  C)  to  25.5°  F  (-3°  C). 
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light  conditions.  This  type  of  accumulation  would  be  consistent  with  the  accident  airplane’s  CVR, 
which  did  not  record  any  crew  discussion  of  perceived  ice  accumulation  and/or  the  need  to 
activate  deicing  boots  during  the  last  5  minutes  of  the  accident  flight. 

The  location  of  rough  ice  coverage  observed  during  the  icing  tunnel  tests  varied, 
depending  on  AOA;  at  lower  AOAs,  the  ice  accretions  extended  farther  aft  on  the  upper  wing 
surface  (to  the  aft  edge  of  the  deicing  boot  on  the  upper  wing  surface,  about  7  percent  of  the  wing 
chord  at  the  aileron  midspan),  whereas  at  higher  AOAs,  the  ice  accretions  extended  farther  aft  on 
the  lower  wing  surface.  In  some  IRT  test  conditions,  sparse  feather-type  ice  accretion  extended 
aft  of  the  deicing  boot  coverage  on  the  lower  wing  surface  (which  extends  to  about  IOV2  percent 
of  the  airfoil  chord  at  the  aileron  midspan)  as  far  as  30  to  35  percent  of  the  airfoil’s  chord." 

The  density  of  the  rough  ice  coverage  also  varied,  depending  on  the  exposure  time;  a 
sparse  layer  of  rough  ice  usually  accreted  on  the  entire  impingement  area  during  the  first 
30  seconds  to  1  minute  of  exposure,  and  the  layer  became  thicker  and  more  dense  as  exposure 
time  increased.  The  NASA-Lewis  and  FAA/UIUC  tests  indicated  that  thin,  rough  ice  accretions 
located  on  the  leading  edge  and  lower  surface  of  the  airfoil  primarily  resulted  in  increases  in  drag, 
while  thin,  rough  ice  accretions  located  on  the  leading  edge  and  upper  wing  surface  had  an 
adverse  effect  on  both  lift  and  drag;  this  is  consistent  with  information  that  has  been  obtained 
during  National  Advisory  Committee  for  Aeronautics/NASA  icing  research  conducted  since  the 
late  1930s.  Data  from  research  conducted  in  the  1940s  and  1950s  indicate  that  an  airfoil’s 
performance  can  be  significantly  affected  by  even  a  relatively  small  amount  of  ice  accumulated  on 
the  leading  edge  area,  if  that  accumulation  has  a  rough,  sandpaper-type  surface. 

Consistent  with  these  data,  NASA’s  drag  calculations  indicated  that  the  thin,  rough  layer 
of  sandpaper-type  ice  accumulation  resulted  in  significant  drag  and  lift  degradation  on 
the  EMB-120  wing  section.  Further,  the  thin  rough  ice  accumulation  resulted  in  a  decrease  in 
stall  AOA  similar  to  that  observed  in  wind  tunnel  tests  with  3-inch  ram’s  horn  ice  shapes  on 
protected  surfaces  and  frequently  demonstrated  a  more  drastic  drop  off/break  at  the  stall  AOA. 
FAA/UIUC  conducted  wind  tunnel  tests  using  generic  shapes  to  represent  the  sandpaper-type 
roughness  with  ridges  placed  on  the  upper  wing  surface  at  6  percent  of  the  wing  chord  (farther  aft 
than  the  ice  ridges  observed  during  NASA’s  IRT  tests);  these  tests  further  demonstrated  that  the 
ridge  type  of  ice  accretion  resulted  in  more  adverse  aerodynamic  effect  than  the  3-inch  ram’s  horn 
ice  shapes. 


11  According  to  NASA-Lewis  scientists,  some  of  the  frost  accretion  observed  aft  of  the  deicing  boot  on  the 
lower  wing  surface  during  the  icing  tunnel  tests  might  have  been  an  artifact  of  the  icing  research  tunnel  (resulting 
from  the  higher  turbulence,  humidity,  and  heat  transfer  characteristics  of  the  tunnel).  However,  the  B.F.  Goodrich 
impingement  study  (which  predicts  ice  accretion  impingement  limits  on  an  airfoil)  and  NASA’s  LEWICE 
computer  program  (which  predicts  the  extent  of  ice  accretion  on  the  leading  edges  of  airplane  wings  and 
impingement  limits  and  ice  thickness  for  specified  conditions  but  cannot  predict  surface  roughness  features)  also 
predicted  a  sparse,  rough  ice  accretion  aft  of  the  deicing  boot  on  the  lower  wing  surface  for  some  of  the  tested 
conditions.  However,  no  ice  accretion  aft  of  the  deicing  boot  was  noticed  during  the  natural  icing  certification 
tests.  Although  it  is  possible  that  some  of  the  drag  observed  in  the  accident  airplane’s  performance  was  the  result 
of  a  sparse,  rough  ice  accumulation  aft  of  the  deicing  boot  on  the  lower  wing  surface,  it  was  not  possible  to 
positively  determine  whether  the  accident  airplane’s  ice  accretion  extended  beyond  the  deicing  boot  coverage. 
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As  previously  noted,  NASA’s  IRT  tests  indicated  that  when  an  EMB-120  wing  is  exposed 
to  conditions  similar  to  those  encountered  by  Comair  flight  3272  before  the  accident,  the  airfoil 
tended  to  accrete  a  small  ice  ridge  (or  ridges)  along  the  deicing  boot  tube  segment  stitchlines. 
During  tests  conducted  at  a  TAT  of  26°  F,  a  small,  but  prominent  ('A  inch)  ridge  of  ice  frequently 
appeared  on  the  forward  portion  (0.5  to  1  percent  mean  aerodynamic  chord)  of  the  leading  edge 
deicing  boot’s  upper  surface. 

The  IRT  test  results  were  used  in  NASA’s  computational  studies,  which  indicated  that 
these  pronounced  ice  ridges  tended  to  act  as  stall  strips,  creating  more  disrupted  airflow  over  the 
airfoil’s  upper  surface,  further  decreasing  the  lift  produced  by  the  airfoil,  and  resulting  in  a  lower 
stall  AO  A  than  the  rough  ice  accretions  alone.  NASA’s  computational  study  data  indicated  that  a 
thin,  rough  ice  accretion  with  a  small,  prominent  ice  ridge  can  result  in  a  lower  stall  AOA  and  a 
more  dramatic  drop  off/break  than  the  3-inch  ram’s  horn  ice  shape  commonly  used  during  initial 
icing  certification  testing. 

The  accident  airplane’s  performance  displayed  evidence  of  adverse  effects  on  both  lift  and 
drag  during  the  airplane’s  descent  to  4,000  feet  msl.  The  degradation  exhibited  by  the  accident 
airplane  was  consistent  with  a  combination  of  thin,  rough  ice  accumulation  on  the  impingement 
area  (including  both  upper  and  lower  wing  leading  edge  surfaces),  with  possible  ice  ridge 
accumulation.  Thus,  based  on  its  evaluation  of  the  weather,  radar,  drag  information,  CVR, 
existing  icing  research  data,  and  postaccident  icing  and  wind  tunnel  test  information,  the  Safety 
Board  concludes  that  it  is  likely  that  Comair  flight  3272  gradually  accumulated  a  thin,  rough 
glaze/mixed  ice  coverage  on  the  leading  edge  deicing  boot  surfaces,  possibly  with  ice  ridge 
formation  on  the  leading  edge  upper  surface,  as  the  airplane  descended  from  7,000  feet  msl  to 
4,000  feet  msl  in  icing  conditions;  further,  this  type  of  ice  accretion  might  have  been  imperceptible 
to  the  pilots. 


The  Safety  Board  notes  that  in  some  icing  exposure  scenarios,  pilots  could  become  aware 
of  the  performance  degradation  without  observing  a  significant  accumulation  of  ice  on  the 
airplane  by  observing  other  cues,  such  as  a  decrease  in  airspeed,  excessive  pitch  trim  usage,  a 
higher-than-normal  amount  of  engine  power  needed  to  maintain  a  stabilized  condition,  and/or 
anomalous  rates  of  climb  or  descent.  However,  the  Safety  Board  concludes  that  because  the 
pilots  of  Comair  flight  3272  were  operating  the  airplane  with  the  autopilot  engaged  during  a  series 
of  descents,  right  and  left  turns,  power  adjustments,  and  airspeed  reductions,  they  might  not  have 
perceived  the  airplane’s  gradually  deteriorating  performance. 

Further,  although  it  is  possible  (based  on  the  icing  reported  by  the  pilots  of  NW  flight  272 
and  the  NCAR  scientist’s  estimation  of  the  likely  droplet  size  distribution  in  the  clouds)  that  the 
accident  flight  encountered  SLD  icing  as  it  reached  4,000  feet  msl,  the  airplane  was  only  at  that 
altitude  for  about  25  seconds  before  the  upset  occurred;  during  most  of  that  25  seconds,  the  FDR 
data  showed  that  the  autopilot  was  countering  the  increasing  left  roll  tendency  and  a  sideslip 


Results  from  the  SLD  icing  tanker  tests  suggest  that  the  visual  cues  for  SLD  ice  accumulations 
(unusually  extensive  ice  accreted  on  the  airframe  in  areas  not  normally  observed  to  collect  ice,  accumulation  of  ice 
on  the  upper  surface  of  the  wing  aft  of  the  protected  area,  and  on  the  propeller  spinner  farther  aft  than  normally 
observed)  would  have  been  veiy  apparent  to  the  pilots  and  might  have  resulted  in  a  comment. 
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condition  was  developing.  However,  even  if  the  accident  flight  had  accumulated  ice  at  the  rapid 
rate  reported  by  the  pilots  of  NW  flight  272  (about  V2  inch  per  minute),  the  accident  flight  could 
not  have  accumulated  a  large  amount  of  ice  during  the  brief  period  of  time  it  spent  at  4,000  feet 
before  the  autopilot  disengaged  and  the  loss  of  control  occurred.  Further,  icing  of  the  magnitude 
described  by  the  pilots  of  NW  flight  272  would  have  produced  strong  visual  cues,  and  it  is  likely 
that  the  pilots  would  have  commented  on  such  a  rapid  accumulation,  had  it  occurred.  The 
accident  airplane’s  CVR  did  not  record  any  flightcrew  comments  about  ice  accumulation  or  the 
need  to  activate  the  leading  edge  deicing  boots  during  the  last  5  minutes  of  the  accident  flight;  this 
is  consistent  with  an  ice  accumulation  that  was  either  not  observed  by  the  pilots  or  that  was 
observed  but  considered  to  be  unremarkable. 

Use  of  Deice/Anti-ice  Equipment 

The  Safety  Board  attempted  to  determine  whether  the  airplane’s  ice  protection  systems 
were  operated  during  the  accident  airplane’s  descent  and  approach  to  DTW.  CVR  information 
showed  that  when  the  pilots  performed  the  descent  checklist  at  1547,  they  confirmed  that  the 
airplane’s  “standard  seven”  anti-ice  systems  were  activated  and  activated  the  windshield  heat  and 
the  propeller  deice  system.13  This  was  consistent  with  guidance  contained  in  Comair’s  EMB-120 
Flight  Standards  Manual  (FSM),  which  stated  that  anti-ice  systems  should  be  activated  “before 
flying  into  known  icing  conditions”  to  prevent  ice  accumulation  on  the  affected  surfaces. 
Comair’s  EMB-120  FSM  defined  icing  conditions  as  existing  “when  the  OAT  [outside  air 
temperature]  is  +5°  C  or  below  and  visible  moisture  in  any  form  is  present  (such  as  clouds,  rain, 
snow,  sleet,  ice  crystals,  or  fog  with  visibility  of  one  mile  or  less).” 

For  years,  airplane  manufacturers  have  incorporated  leading  edge  deicing  boots  in  the 
design  of  airplanes  that  are  to  be  certificated  for  operation  in  icing  conditions;  the  purpose  of 
deicing  boots  is  to  shed  the  ice  that  accumulates  on  protected  surfaces  of  the  airframe.  Over  the 
years,  leading  edge  deicing  boots  have  demonstrated  their  effectiveness  to  operators  and  pilots  by 
keeping  the  wing  and  tail  leading  edges  relatively  clear  of  aerodynamically  degrading  ice 
accumulations,  to  the  point  that  operators  and  pilots  have  become  confident  that  the  airplanes  can 
be  flown  safely  in  icing  conditions  as  long  as  the  airplane’s  deicing  boots  are  operated  (and 
functioning)  properly.  However,  based  on  problems  with  earlier  deicing  boot  designs  (which  used 
larger  tubes  and  lower  pressures,  resulting  in  slower  inflation/deflation  rates),  manufacturers, 
operators,  and  pilots  developed  the  belief  that  premature  activation  of  the  leading  edge  deicing 
boots  could  (as  cautioned  in  Comair’s  EMB-120  FSM)  “result  in  the  ice  forming  the  shape  of  an 
inflated  de-ice  boot,  making  further  attempts  to  deice  in  flight  impossible  [ice  bridging].”  Thus,  at 
the  time  of  the  accident,  Comair’s  (and  most  other  EMB-120  operators’)  guidance  indicated  that 
pilots  should  delay  activation  of  the  leading  edge  deicing  boots  until  they  observed  14  inch  to  Vi 
inch  ice  accumulation,  despite  Embraer’s  FAA  and  Centro  Tecnico  Aeroespacial  of  Brazil  (CTA) 
approved  EMB-120  Airplane  Flight  Manual  (AFM)  revision  43,  which  indicated  that  pilots  should 
activate  the  leading  edge  deicing  boots  at  the  first  sign  of  ice  accumulation. 


13  Although  Embraer’s  nomenclature  identifies  the  propeller  ice  protection  mechanism  as  a  deicing 
system,  it  functions  as  an  anti-icing  system  because  it  is  activated  before  ice  accumulates  on  the  airframe. 
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The  pilots’  activation  of  the  propeller  and  windshield  ice  protection  systems  when  the 
airplane  entered  the  clouds  would  indicate  that  they  were  aware  that  the  airplane  was  operating  in 
icing  conditions.  If  they  had  activated  the  leading  edge  deicing  boots,  at  least  some  of  the 
airplane’s  degraded  performance  would  have  been  restored.  However,  even  if  the  pilots  observed 
any  of  the  thin,  rough  ice  accretion  that  likely  existed  before  the  loss  of  control,  they  probably 
would  not  have  activated  the  deicing  boots  because  Comair’s  guidance  to  its  pilots  advised 
against  activating  the  deicing  boots  until  they  observed  a  thicker  ice  accumulation.  Therefore, 
based  on  CVR  information  and  on  the  steady  degradation  of  airplane  performance  that  was  clearly 
uninterrupted  by  leading  edge  deicing  boot  activation,  the  Safety  Board  concludes  that,  consistent 
with  Comair’s  procedures  regarding  ice  protection  systems,  the  pilots  did  not  activate  the  leading 
edge  deicing  boots  during  their  descent  and  approach  to  the  Detroit  area,  likely  because  they  did 
not  perceive  that  the  airplane  was  accreting  significant  (if  any)  structural  ice. 

During  the  postaccident  (November  1997)  Airplane  Deicing  Boot  Ice  Bridging  Workshop, 
information  regarding  recent  icing  tunnel  and  flight  test  research  into  the  ice  bridging  phenomenon 
was  disseminated  and  discussed  among  industry  personnel.  The  recent  research  revealed  that 
modem  turbine-powered  airplanes,  with  their  high-pressure,  segmented  pneumatic  deicing  boots, 
are  not  at  risk  for  ice  bridging.14  However,  in  April  1996  when  Embraer  issued  (FAA-  and  CTA- 
approved)  revision  43  to  the  EMB-120  AFM,  the  procedure  it  recommended — activation  of  the 
leading  edge  deicing  boots  at  the  first  sign  of  ice  accretion— was  not  consistent  with  traditional 
industry  concerns  about  ice  bridging.  According  to  the  FAA’s  EMB-120  Aircraft  Certification 
Program  Manager,  when  the  EMB-120  AFM  revision  was  proposed  by  Embraer  in  late  1995,  the 
deicing  boot  procedural  change  was  very  controversial  and  generated  numerous  discussions 
among  FAA  and  industry  personnel.  The  FAA’s  EMB-120  Aircraft  Certification  Program 
Manager  stated  that  the  aircraft  evaluation  group  personnel  involved  in  the  discussions  about  the 
six  EMB-120  icing-related  events,  the  EMB-120  in-flight  icing  tanker  tests,  and  the  deicing  boot 
procedural  change  were  initially  resistant  to  the  deicing  boot  procedural  change  because  of  the 
perceived  potential  for  ice  bridging. 

The  Safety  Board  notes  that  during  the  winter  of  1995/1996,  senior  Comair  personnel 
(and  representatives  from  other  EMB-120  operators)  were  involved  in  numerous  meetings  and 
discussions  regarding  the  six  preaccident  icing-related  events  and  that  they  subsequently  received 
Embraer’s  Operational  Bulletin  120-002/96  and  revision  43  to  the  EMB-120  AFM,  with  its 
controversial  deicing  boot  procedural  change.  Although  these  discussions  and  documents 
apparently  heightened  senior  Comair  personnel’s  awareness  and  concern  about  EMB-120 
operations  in  icing  conditions  (as  evidenced  by  the  December  1995  interoffice  memo,  entitled 
“Winter  Operating  Tips,”  and  the  October  1996  flight  standards  bulletin  96-04,  entitled  “Winter 
Flying  Tips”),  until  the  (postaccident)  ice  bridging  workshop,  there  was  insufficient  information 
available  to  allay  the  company’s  concerns  regarding  the  perceived  hazards  of  ice  bridging. 
Because  Comair  management  personnel  were  still  concerned  that  ice  bridging  was  a  problem  for 
modem  turbopropeller-driven  airplanes,  at  the  time  of  the  accident,  the  company’s  deicing  boot 
activation  procedures  had  not  been  revised  in  accordance  with  AFM  revision  43.  The  Safety 
Board  recognizes  the  concerns  regarding  ice  bridging  that  Comair  had  at  the  time  of  the  accident 


14  It  is  important  to  note  that  ice  bridging  may  still  be  a  potential  hazard  for  airplanes  with  older 
technology  deicing  boots  that  have  slower  inflation/deflation  rates. 


10 


(before  the  ice  bridging  workshop)  and  notes  that  the  FAA  had  not  mandated  incorporation  of  the 
procedural  revision  or  engaged  in  discussions  with  EMB-120  operators/pilots  regarding  the  merit 
of  the  procedural  change.  Apparently,  Comair  was  not  the  only  EMB-120  operator  with  concerns 
regarding  the  deicing  boot  procedural  change  because  the  air  carriers’  records  indicated  that  at  the 
time  of  the  accident,  only  two  of  seven  U.S.-based  EMB-120  operators  had  incorporated  the 
revision  into  its  procedural  guidance.  However,  the  Board  is  concerned  that  Comair’ s  EMB-120 
pilots  did  not  have  access  to  the  most  current  information  regarding  operating  the  EMB-120  in 
icing  conditions. 

According  to  EMB-120  pilots  from  Comair  and  the  Air  Line  Pilots  Association  (ALPA), 
their  discussions  with  other  EMB-120  flightcrews  indicate  that  the  procedural  change  is  still  a 
controversial  issue,  despite  the  information  revealed  during  this  accident  investigation  and  at  the 
November  1997  Airplane  Deicing  Boot  Ice  Bridging  Workshop.  This  illustrates  how  thoroughly 
ingrained  the  ice  bridging  concept  was  in  pilots  and  operators  and  the  importance  of  an  ice 
bridging  pilot  education  program.  Therefore,  a  thin,  yet  performance-decreasing  type  of  ice 
(similar  to  that  likely  accumulated  by  Comair  flight  3272)  can  present  a  more  hazardous  situation 
than  a  3-inch  ram’s  horn  ice  accumulation  because  it  would  not  necessarily  prompt  the  activation 
of  the  boots.  Based  on  this  information,  the  Safety  Board  concludes  that  the  current  operating 
procedures  recommending  that  pilots  wait  until  ice  accumulates  to  an  observable  thickness  before 
activating  leading  edge  deicing  boots  results  in  unnecessary  exposure  to  a  significant  risk  for 
turbopropeller-driven  airplane  flight  operations.  Based  primarily  on  concerns  about  ice  bridging, 
pilots  continue  to  use  procedures  and  practices  that  increase  the  likelihood  of  (potentially 
hazardous)  degraded  airplane  performance  resulting  from  small  amounts  of  rough  ice  accumulated 
on  the  leading  edges. 

The  Safety  Board  is  aware  that  the  FAA,  NASA,  and  ALPA  plan  to  organize  an 
industry-wide  air  carrier  pilot  training  campaign  to  increase  pilots’  understanding  of  the  ice 
bridging  phenomenon  and  safe  operation  of  deicing  boots.  Unfortunately,  according  to  NASA 
personnel,  the  training  program  has  not  yet  begun  because  the  FAA  is  still  developing  its  position 
based  on  information  from  the  Ice  Bridging  Workshop.  The  Safety  Board  appreciates  the  FAA’s 
intention  to  initiate  the  development  of  ice  bridging  training  and  its  desire  to  ensure  that  the 
training  is  as  thorough  and  accurate  as  possible;  however,  the  Board  is  concerned  that  the  planned 
training  is  being  delayed.  Further,  the  planned  training  primarily  targets  air  carrier  pilots,  and  the 
Board  considers  it  important  that  the  information  be  disseminated  to  all  affected  pilots/operators. 
The  Safety  Board  is  concerned  that  if  nonair  carrier  pilots  and  operators  do  not  receive  the 
training,  they  may  operate  turbopropeller-driven  airplanes  in  icing  conditions  using  deicing  boot 
procedures  that  result  in  less  safe  flight  operations.  A  training  program  that  reaches  only  a  limited 
part  of  the  pilot  population  may  not  be  sufficient  to  eliminate  the  pervasive  beliefs  regarding  the 
potential  for  ice  bridging  in  turbopropeller-driven  airplanes. 

Therefore,  the  Safety  Board  believes  that  NASA  should  (with  the  FAA  and  other 
interested  aviation  organizations)  organize  and  implement  an  industry-wide  training  effort  to 
educate  manufacturers,  operators,  and  pilots  of  air  carrier  and  general  aviation  turbopropeller- 
driven  airplanes  regarding  the  hazards  of  thin,  possibly  imperceptible,  rough  ice  accumulations, 
the  importance  of  activating  the  leading  edge  deicing  boots  as  soon  as  the  airplane  enters  icing 
conditions  (for  those  airplanes  in  which  ice  bridging  is  not  a  concern),  and  the  importance  of 
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maintaining  minimum  airspeeds  in  icing  conditions.  The  Safety  Board  encourages  NASA  and  the 
FAA  to  expedite  this  training  effort. 

It  is  important  to  note  that  although  leading  edge  deicing  boots  are  useful  in  minimizing 
the  adverse  affects  of  ice  accumulation  on  an  airplane’s  protected  surfaces,  activation  of  deicing 
boots  does  not  result  in  a  completely  clean  boot  surface;  some  residual  ice  remains  on  the  deicing 
boot  after  it  cycles,  and  intercycle  ice  accumulates  between  deicing  boot  cycles  (on  the  EMB-120, 
during  the  54-second  or  174-second  intervals,  depending  on  the  mode  of  boot  operation 
selected).  Icing  tunnel  tests  indicate  that  when  the  deicing  boots  are  activated  early,  the  initial 
deicing  boot  cycle  leaves  a  higher  percentage  of  residual  ice  than  it  would  with  delayed  deicing 
boot  activation.  However,  when  the  deicing  boots  remained  operating  during  the  remainder  of 
the  ice  encounter,  subsequent  deicing  boot  cycles  resulted  in  a  wing  leading  edge  about  as  clean 
as  would  occur  with  delayed  boot  activation. 


The  FAA/UIUC  wind  tunnel  tests  revealed  that  even  a  thin,  sparse  (5  percent  to 
10  percent  density  ice  coverage)  amount  of  rough  ice  accumulation  over  the  leading  edge  deicing 
boot  coverage  area  resulted  in  significant  aerodynamic  degradation.  This  information  raises 
questions  about  the  effectiveness  of  leading  edge  deicing  boots  when  dealing  with  this  type  of  ice 
accumulation,  especially  considering  a  B.F.  Goodrich  estimation  that  a  good,  effective  deicing 
boot  shed  leaves  about  20  percent  of  the  accumulated  ice  on  the  boots.  The  sparse  ice  coverage 
observed  during  the  first  30  to  60  seconds  of  exposure  time  in  some  of  NASA’s  icing  tunnel  test 
conditions  (and  which  could  occur  between  deicing  boot  cycles)  was  estimated  by  observers  to  be 
about  10  percent.  This  combined  research  indicates  that  it  is  possible  for  a  hazardous  situation  to 
occur  even  if  pilots  operate  the  deicing  boots  early  and  throughout  the  icing  encounter.  The 
Westair  flight  7233  incident,  in  which  uncommanded  roll  and  pitch  excursions  occurred  despite 
the  fact  that  the  pilots  stated  that  they  had  activated  the  leading  edge  deicing  boots  and  selected 
the  heavy  boot  operation  mode,15  may  be  an  example  of  such  a  hazardous  situation. 

In  addition,  a  hazardous  situation  may  develop  even  if  deicing  boots  are  operated 
throughout  an  icing  encounter  as  a  result  of  ice  accretions  on  an  airplane’s  unprotected  surfaces, 
such  as  aft  of  the  deicing  boots.  The  B.F.  Goodrich  impingement  study,  NASA’s  LEWICE 
calculations,  and  NASA  IRT  tests  indicated  that  a  light  accretion  may  occur  on  the  unprotected 
lower  wing  surfaces  aft  of  the  deicing  boot  on  the  EMB-120.  However,  Embraer  representatives 
stated  that  such  an  ice  accretion  would  result  in  only  a  trace  of  ice  accumulating  aft  of  the  deicing 
boots  and  would  have  a  minimal  aerodynamic  penalty  in  drag  only.  Although  there  was  no 
evidence  of  ice  accretion  aft  of  the  deicing  boot  during  the  EMB-120  certification  natural  icing 
tests  and  it  was  not  possible  to  determine  whether  the  accident  airplane’s  ice  accretion  extended 
aft  of  the  deicing  boot  coverage,  it  is  possible  that  ice  accretion  on  the  unprotected  surface  aft  of 
the  deicing  boot  could  exacerbate  a  potentially  hazardous  icing  situation. 


According  to  the  pilots  of  Westair  flight  7233,  they  were  aware  that  they  were  operating  in  “icing 
conditions,”  they  stated  that  they  observed  ice  accumulating  on  the  airplane  and  had  activated  the  leaning  e(ige 
deicing  boots  when  the  airplane  entered  the  clouds  during  their  departure. 
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Based  on  icing  and  wind  tunnel  research  and  information  from  the  Westair  incident,  the 
Safety  Board  concludes  that  it  is  possible  that  ice  accretion  on  unprotected  surfaces  and  intercycle 
ice  accretions  on  protected  surfaces  can  significantly  and  adversely  affect  the  aerodynamic 
performance  of  an  airplane  even  when  leading  edge  deicing  boots  are  activated  and  operating 
normally.  Thus,  pilots  can  minimize  (but  not  always  prevent)  the  adverse  effects  of  ice 
accumulation  on  the  airplane’s  leading  edges  by  activating  the  leading  edge  deicing  boots  at  the 
first  sign  of  ice  accretion.  It  is  not  clear  what  effect  residual  ice/ice  accretions  on  unprotected 
nonleading  edge  airframe  surfaces  have  on  flight  handling  characteristics.  Because  not  enough  is 
known  or  understood  about  icing  in  general,  and  especially  about  the  effects  of  intercycle  and 
residual  ice,  the  Safety  Board  believes  that  NASA  should  (with  the  FAA  and  other  interested 
aviation  organizations)  conduct  additional  research  to  identify  realistic  ice  accumulations,  to 
include  intercycle  and  residual  ice  accumulations  and  ice  accumulations  on  unprotected  surfaces 
aft  of  the  deicing  boots,  and  to  determine  the  effects  and  criticality  of  such  ice  accumulations; 
further,  the  information  developed  through  such  research  should  be  incorporated  into  aircraft 
certification  requirements  and  pilot  training  programs  at  all  levels. 

Therefore,  the  National  Transportation  Safety  Board  makes  the  following 
recommendations  to  the  National  Aeronautics  and  Space  Administration: 

With  the  Federal  Aviation  Administration  and  other  interested  aviation  organizations, 
organize  and  implement  an  industry-wide  training  effort  to  educate  manufacturers, 
operators,  and  pilots  of  air  carrier  and  general  aviation  turbopropeller-driven  airplanes 
regarding  the  hazards  of  thin,  possibly  imperceptible,  rough  ice  accumulations,  the 
importance  of  activating  the  leading  edge  deicing  boots  as  soon  as  the  airplane  enters 
icing  conditions  (for  those  airplanes  in  which  ice  bridging  is  not  a  concern),  and  the 
importance  of  maintaining  minimum  airspeeds  in  icing  conditions.  (A-98-107) 

With  the  Federal  Aviation  Administration  and  other  interested  aviation  organizations, 
conduct  additional  research  to  identify  realistic  ice  accumulations,  to  include  intercycle 
and  residual  ice  accumulations  and  ice  accumulations  on  unprotected  surfaces  aft  of 
the  deicing  boots,  and  to  determine  the  effects  and  criticality  of  such  ice 
accumulations;  further,  the  information  developed  through  such  research  should  be 
incorporated  into  aircraft  certification  requirements  and  pilot  training  programs  at  all 
levels.  (A-98-108) 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMIDT, 
GOGLIA,  and  BLACK  concurred  in  these  recommendations. 
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National  Transportation  Safety  Board 

Washington  D.C.  20594 

Safety  Recommendation 


Date:  September  14,  1998 

In  reply  refer  to:  A-98-109  through  -110 


Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 _ 


On  October  15,  1997,  about  1030  mountain  daylight  time,  a  Cessna  P210N, 
N731NX,  operated  by  the  Sheriffs  Department  of  Mesa  County,  Colorado, 
experienced  an  in-flight  electrical  fire  while  cruising  at  16,500  feet  over  Bryce  Canyon, 
Utah.  The  commercial  pilot  initiated  an  emergency  descent  and  landed  uneventfully  in 
Bryce  Canyon  with  minor  damage.  The  pilot  and  his  passenger  were  not  injured. 
Visual  meteorological  conditions  prevailed,  and  a  visual  flight  rules  flight  plan  had 
been  filed.  The  public-use  flight  was  conducted  under  Title  14  Code  of  Federal 
Regulations  Part  91,  and  originated  from  Grand  Junction,  Colorado,  about  60  minutes 
before  the  incident. 

The  Safety  Board’s  investigation  revealed  that  the  fire  originated  on  the  cabin 
sidewall,  under  the  left  side  of  the  instrument  panel,  and  resulted  in  burned  vinyl, 
plastic,  and  insulation  material.1  The  fire  was  caused  by  an  overheated  resistor  used  in 
an  electric  door  seal  inflation  system.  The  resistor  was  used  to  reduce  the  28-volt 
aircraft  electrical  system’s  voltage  to  meet  the  power  requirements  of  the  door  seal 
system’s  14-volt  air  pump  motor.  The  system  had  been  installed  on  the  airplane  in 
accordance  with  a  Federal  Aviation  Administration  (FAA)-approved  supplemental  type 
certificate  (STC)2  that  was  issued  to  the  system’s  manufacturer,  Bob  Fields 
Aerocessories,  Inc.,  in  1983.  The  purpose  of  the  system  is  to  decrease  in-flight  cabin 


1  Bryce  Canyon,  Utah,  October  15,  1997,  Cessna  P210N,  N731NX  (FTW98TA051). 

2  A  supplemental  type  certificate  can  be  issued  by  the  FAA  for  design  changes  to  type-certificated  aircraft 
when  the  change  is  not  so  extensive  as  to  require  a  new  type  certificate  for  that  aircraft.  STCs  are 
typically  approved  for  optional  after-market  kits  that  improve  an  aircraft  design.  The  STC  applicant  must 
submit  sufficient  technical  data  to  the  FAA  to  show  compliance  with  the  applicable  certification 
requirements. 
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noise  caused  by  ill-fitting  cabin  doors.  According  to  Bob  Fields  Aerocessories,  about 
20,000  of  these  systems  are  currently  installed  in  a  wide  variety  of  single-  and  twin- 
engine  general  aviation  airplanes. 

Since  the  Bryce  Canyon  incident  in  October  1997,  the  Safety  Board  has 
investigated  one  accident  and  two  incidents  that  also  involved  in-flight  fires  originating 
in  electric  inflatable  door  seal  systems  manufactured  by  Bob  Fields  Aerocessories. 
Moreover,  a  review  of  the  FAA’s  Service  Difficulty  Report  database  revealed  four 
additional  reports  of  overheated  components  associated  with  the  door  seal  system, 
three  of  which  cited  smoke  in  the  cockpit.  A  description  of  the  recent  accident  and 
incidents  investigated  by  the  Safety  Board  follows. 

On  November  20,  1997,  a  Beech  95-B55,  N3681K,  sustained  substantial 
damage  after  impacting  trees  during  a  precautionary  landing  in  Burlington,  Kansas. 
The  landing  was  precipitated  by  smoke  and  an  electrical  fire  in  the  cabin  during  cruise 
flight  at  6,500  feet.  Postaccident  examination  of  the  airplane  revealed  that  a  Bob  Fields 
Aerocessories  electric  door  seal  inflation  pump,  mounted  on  the  forward  side  of  the 
nose  bulkhead,  was  heavily  charred.  The  Safety  Board  determined  that  the  probable 
cause  of  the  accident  was,  in  part,  “the  door  seal  inflation  pump  catching  fire.”3 

On  June  25,  1998,  the  pilot  of  a  Cessna  P210N,  N5083W,  initiated  a 
precautionary  landing  in  Ithaca,  New  York,  after  heavy  smoke  had  entered  the  cabin 
during  cruise  flight  at  5,000  feet.  Immediately  after  the  landing,  airport  fire  and  rescue 
personnel  discovered  a  self-sustaining  fire  originating  under  the  left  side  of  the 
instrument  panel.  Vinyl,  plastic,  and  insulation  material  had  burned  in  the  fire. 
Subsequent  examination  of  the  airplane  revealed  that  one  of  the  resistors  used  in  the 
Bob  Fields  Aerocessories  electric  door  seal  inflation  system  installed  on  the  airplane 
was  partially  melted.4  The  Safety  Board  recently  learned  of  a  July  17,  1998,  incident 
aboard  a  Beech  58  airplane  in  which  the  pilot  reported  a  burning  smell  in  the  cockpit 
while  in  cruise  flight.  He  landed  in  Toms  River,  New  Jersey,  and  asked  a  mechanic  to 
inspect  the  airplane.  The  mechanic  reported  that  the  pump  assembly  and  resistors  for 
the  installed  Bob  Fields  Aerocessories  electric  door  seal  inflation  system,  mounted  in 
the  nose  compartment,  were  partially  melted.5 

The  electric  door  seal  inflation  system  manufactured  by  Bob  Fields 
Aerocessories  consists  of  an  electric  motor,  an  air  pump,  inflatable  silicon  door  seals,  a 
pressure  sensing  switch,  an  air  supply  control  valve,  a  resistor  assembly,  a  7.5-amperes 
(amps)  in-line  fuse,  a  caution  light,  and  electrical  wiring.  A  5-amp  circuit  breaker  may 
also  be  provided  as  an  option.  The  motor  draws  power  directly  from  the  airplane's 
battery  bus  and  is  used  to  inflate  the  door  seals  to  a  pressure  of  about  10  pounds  per 


3  For  more  detailed  information,  see  Brief  of  Accident  CHI98LA041  (enclosed). 
"Ithaca,  New  York,  June  25, 1998,  Cessna  P210N,  N5083W  (NYC98SA138). 
^oms  River,  New  Jersey,  July  17, 1998,  Beech  58,  N53RD  (NYC98SA167). 
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square  inch  (psi).  A  sensor  on  the  air  pump  determines  when  the  pressure  drops  below 
10  psi,  at  which  time  the  air  pump  motor  cycles  back  on  until  the  proper  pressure  is 
achieved.  According  to  the  STC-holder,  it  takes  between  4  and  12  seconds  after 
system  activation  for  the  air  pump  to  inflate  the  door  seal;  during  this  time,  the  caution 
light  remains  illuminated.  If  the  door  seal  has  a  small  leak,  the  pump  cycles  on  and  off 
to  maintain  the  desired  inflation  pressure.  If  the  door  seal  has  a  larger  leak,  the  air 
pump  may  run  continuously  to  keep  the  door  seal  inflated. 

The  Safety  Board’s  review  of  the  system  design  revealed  that  the  system 
incorporates  two  identical  1-ohm  resistors,  each  rated  for  a  maximum  of  50  watts.  The 
resistors  are  wired  close  together  and  in  series.  According  to  technical  specifications 
provided  by  the  vendor  of  the  resistor,  the  resistor’s  wattage  capability  should  be 
derated  to  no  more  than  20  watts  if  it  is  not  mounted  onto  a  sufficiently  sized 
conductive  structure  for  heat  dissipation.  Test  data  from  the  vendor  further  indicate 
that  the  aluminum  housing  of  a  single  resistor  will  heat  up  to  3 13°  F  when  the  resistor 
carries  the  nominal  wattage  of  the  door  seal  inflation  system  and  is  adequately 
mounted  to  provide  for  heat  dissipation.6  The  housing  temperature  rises  to  more  than 
600°  F  if  the  resistor  is  not  mounted  to  conductive  material  for  heat  dissipation.  The 
potential  for  overheating  is  increased  by  the  two  resistors  being  wired  closely  together. 

The  Safety  Board  reviewed  the  FAA-approved  installation  instructions  for  the 
Bob  Fields  Aerocessories  electric  inflatable  door  seal  pump.  The  instructions  state, 
“...be  sure  to  mount  the  resistors  pak  [sic]  to  a  metal  plate  to  make  a  heat  sink.  This 
plate  and  resistors  can  be  mounted  at  the  parking  brake  support  angle  under  the 
instrument  panel.”  No  other  instructions  are  found  related  to  the  resistor  mounting. 
The  investigations  into  the  Biyce  Canyon,  Ithaca,  and  Toms  River  incidents  revealed 
that  the  resistors  were  either  hanging  freely,  or  were  mounted  to  structure  in  a  manner 
that  was  insufficient  to  dissipate  the  heat  generated  by  the  resistors.  The  Safety  Board 
is  concerned  that  the  installation  instructions  are  insufficient  and  do  not  provide 
enough  detail  or  cautions  regarding  the  proper  installation  of  the  resistors  and  the 
minimum  specifications  for  a  heat  sink. 

The  Safety  Board  is  also  concerned  about  other  aspects  of  the  design  of  the 
door  seal  inflation  system  that  can  lead  to  the  overheating  of  the  resistors  and  other 
system  components.  The  design  calls  for  the  system  to  be  installed  in  confined  areas 
on  the  aircraft.  For  example,  in  the  two-door  Cessna  airplane  models,  the  STC 
suggests  that  the  system  be  mounted  behind  the  pilot’s  “kick  panel.”  The  kick  panel 
area  is  a  confined  space  between  the  external  skin  of  the  airplane  just  forward  of  the 
door  and  an  upholstered  panel  under  the  left  side  of  the  pilot’s  instrument  panel.  This 
space  has  limited  ventilation  and  inhibits  the  cooling  required  for  a  continuously 


6  The  door  seal  inflation  system  draws  a  nominal  current  of  6  amps,  thereby  producing  36  watts  of  power 
through  each  1-ohm  resistor.  Test  data  indicate  that  36  watts  of  applied  power  through  the  specified 
resistor  that  is  mounted  on  top  of  a  box-shaped,  aluminum  chassis  for  heat  conduction  (0.040  inch  thick,  5 
inches  wide,  7  inches  long,  and  2  inches  deep)  will  produce  a  housing  temperature  of  3 13°  F. 
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operating  electrical  pump  and  its  associated  resistors.  The  space  also  provides 
potentially  combustible  materials  in  close  proximity  to  heated  electrical  components, 
as  illustrated  by  the  Bryce  Canyon  and  Ithaca  incidents. 

Another  aspect  of  the  door  seal  inflation  system  design  that  could  lead  to 
overheating  involves  the  endurance  rating  of  the  electrically  driven  air  pump. 
According  to  the  vendor  that  supplies  the  air  pump  to  Bob  Fields  Aerocessories,  the 
pump  was  originally  designed  to  be  plugged  into  an  automotive  cigarette  lighter  socket 
and  was  intended  to  be  used  for  the  emergency  inflation  of  automobile  tires.  In  a  letter 
forwarded  to  the  Safety  Board,  the  vendor  stated  that  the  continuous  use  of  the  pump 
“should  not  exceed  10  minutes  without  stopping  for  30  minutes”  to  prevent 
overheating.  The  application  of  the  air  pump  for  the  pressurization  of  airplane  door 
seals  during  flight  is  inappropriate  because  the  pump  may  be  required  to  operate  for 
more  than  10  minutes,  or  to  run  continuously  if  the  door  seal  leaks.  This  was 
illustrated  in  the  Bryce  Canyon  incident  when  the  caution  light  was  observed  by  the 
pilot  to  be  continuously  illuminated.  The  Safety  Board  is  concerned  that  extended  or 
continuous  operation  of  the  air  pump  will  lead  to  excessive  heat  buildup,  causing  an 
excessive  current  draw,  and  will  exacerbate  the  potential  for  overheating  that  already 
exists  under  the  nominal  current  draw. 

Examination  of  the  in-line  fuses  for  the  Bryce  Canyon,  Ithaca,  and  Toms  River 
incidents  revealed  that  a  fuse  rated  for  10  amps  had  been  installed  in  the  door  seal 
inflation  system,  exceeding  the  7.5-amp-rated  fuse  specified  by  the  approved  STC 
installation  instructions.  The  Safety  Board  notes  that  excessive  current  draw  may 
result  in  frequent  blown  fuses  and  may  prompt  the  improper  installation  of  a  higher¬ 
rated  fuse.  Although  the  improper  use  of  a  10-amp-rated  fuse  increases  the  potential 
for  overheating  components,  the  use  of  the  specified  7.5-amp-rated  fuse  would  not 
eliminate  the  hazard  because,  as  discussed  above,  testing  has  shown  that  overheating 
of  the  resistors  can  occur  at  the  nominal  door  seal  inflation  system  current  of  6  amps. 

The  Safety  Board  is  also  concerned  that  the  electric  door  seal  inflation  system 
design  does  not  provide  adequate  warning  of  a  potential  overheat  situation.  The 
system  incorporates  an  amber  (caution)  light  on  the  pilot’s  instrument  panel  that 
illuminates  when  the  pump  is  operating.  The  STC  installation  instructions  specify  that 
a  placard  be  placed  near  the  light  stating,  “CAUTION/DOOR  SEAL  PUMP  ON.” 
However,  no  information  is  provided  on  action  to  take  if  the  light  remains  illuminated 
for  an  extended  period. 

The  Safety  Board  concludes  that  the  Bob  Fields  Aerocessories  door  seal 
inflation  system  design  does  not  provide  owners  or  operators  with  adequate 
information  about  corrective  action  if  the  system  begins  to  overheat.  Also,  it  may  not 
become  apparent  to  an  operator  that  the  system  is  overheating  until  there  are 
indications  of  an  electrical  fire.  The  system  design  does  not  incorporate  its  own 
electrical  cut-off  switch;  therefore,  the  pilot’s  only  means  to  address  an  overheating 
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system  or  component  is  to  turn  off  the  airplane’s  entire  electrical  power  system  using 
the  master  switch. 

The  Safety  Board  is  very  concerned  that  these  design  deficiencies  increase  the 
likelihood  of  an  in-flight  electrical  fire  and/or  smoke  in  the  cockpit  during  flight,  as 
evidenced  by  the  accident  and  incidents  discussed  above,  as  well  as  additional 
incidents  identified  by  SDRs.  Therefore,  the  Safety  Board  believes  that  the  FAA 
should  issue  an  airworthiness  directive  to  require  that  all  owners  and  operators  of 
airplanes  equipped  with  electric  door  seal  inflation  pump  systems  manufactured  by 
Bob  Fields  Aerocessories  immediately  disconnect  them  from  the  airplanes’  electrical 
systems.  In  addition,  the  FAA  should  review  all  STCs  that  provide  for  the  installation 
of  electric  door  seal  inflation  pump  systems  manufactured  by  Bob  Fields 
Aerocessories,  and  require  revisions,  as  necessary,  to  ensure  that  the  hazards 
associated  with  in-flight  fire  and/or  smoke  in  the  cockpit  during  flight  are  eliminated. 
Existing  systems  should  be  required  to  comply  with  those  instructions  before  they  are 
placed  back  into  service. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the 
Federal  Aviation  Administration: 

Issue  an  airworthiness  directive  to  require  that  all  owners  and 
operators  of  airplanes  equipped  with  electric  door  seal  inflation 
pump  systems  manufactured  by  Bob  Fields  Aerocessories 
immediately  disconnect  them  from  the  airplanes’  electrical 
systems.  (Urgent)  (A-98- 109) 

Review  all  supplemental  type  certificates  that  provide  for  the 
installation  of  electric  door  seal  inflation  pump  systems 
manufactured  by  Bob  Fields  Aerocessories,  and  require 
revisions,  as  necessary,  to  ensure  that  the  hazards  associated  with 
in-flight  fire  and/or  smoke  in  the  cockpit  during  flight  are 
eliminated.  Existing  systems  should  be  required  to  comply  with 
those  instructions  before  they  are  placed  back  into  service 
(A-98-110) 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members 
HAMMERSCHMIDT,  GOGLIA,  and  BLACK  concurred  in  these  recommendations. 
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National  Transportation  Safety  Board 

Washington,  D.C.  20594 


Safety  Recommendation 


Date:  October  7,  1998 

In  reply  refer  to:  A-98-111 


Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  February  20,  1997,  at  0645  central  standard  time,  a  Douglas  DC-9- 15,  N93S, 
operated  as  Northwest  Airlines  (NWA)  flight  219  under  Title  14  Code  of  Federal  Regulations 
Part  121,  from  Minneapolis,  Minnesota,  to  Kansas  City,  Missouri,  experienced  an  in-flight 
electrical  fire,  which  filled  the  cockpit  with  smoke  and  fumes.  The  crew  donned  their  oxygen 
masks  and  turned  off  both  generators  and  the  battery  switch.  They  flew  with  a  flashlight  for  1 
minute  and  then  turned  the  emergency  power  switch  on  after  the  flames  had  extinguished 
themselves.  The  flightcrew  declared  an  emergency,  and  the  flight  was  diverted  to  the  Des 
Moines  International  Airport,  Des  Moines,  Iowa,  and  landed  without  further  incident.  None 
of  the  4  crewmembers  or  the  32  passengers  on  board  were  injured,  and  the  airplane  sustained 
minor  damage. 

Examination  of  the  airplane  indicated  that  the- electrical  fire  originated  within  the  power 
distribution  system’s  cross-tie  relay,  Westinghouse1  part  number  (P/N)  914F567-4.  The  cross¬ 
tie  relay  allows  either  the  left  or  right  three-phase2  alternating  current  (AC)  generator  to  supply 
electrical  power  to  all  AC  buses.  Seven  relays  of  this  type  are  used  in  each  DC-9  series 
airplane  to  provide  electrical  power  source  switching,  including  the  cross-tie  relay,  left  and 
right  (L&R)  generator  relays  (GR),  L&R  auxiliary  power  relays  (APR),  and  L&R  external 
power  relays  (EPR).  These  seven  relays  are  mounted  in  the  electrical  power  center  (EPC) 
distribution  panel  in  the  cockpit. 

Examination  of  the  cross-tie  relay  from  N93S  revealed  that  the  failure  resulted  from  a 
phase-to-phase  short,3  which  was  caused  by  the  presence  of  main  contact  wear  products 


1  Now  Sundstrand  Corporation. 

2  Comprises  three  single-phase  windings  that  each  produce  a  continuously  alternating  voltage/current. 

3  Low  resistance  connection  between  two  conductors  normally  insulated  from  each  other  (i.e.  short  circuit). 
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(debris)  throughout  the  contact  housing  (arc  box).  NWA’s  records  indicated  that  the  relay  had 
35,160  hours  total  time  and  7,775  hours  since  the  last  overhaul. 

An  examination  of  Douglas  Aircraft  Company4  (DAC)  incident  summary  reports 
indicated  that  on  November  5,  1974,  a  DC-9-31  experienced  a  similar  cross-tie  failure,  during 
an  approach  for  landing,  in  which  smoke  and  sparks  emitting  from  the  EPC  panel  caused  an 
emergency  evacuation  after  landing.  On  June  5,  1975,  another  cross-tie  relay  caught  fire  in  a 
DC-9-15  during  taxi  for  takeoff.  The  smoke  reportedly  was  so  thick  aft  of  the  cockpit  that  the 
flight  attendant  was  unable  to  locate  the  cockpit  call  button;  she  had  to  go  to  the  rear  of  the 
aircraft  to  use  the  call  button  to  inform  the  crew  about  the  fire.  Westinghouse  concluded  that 
the  most  likely  cause  of  these  failures  was  a  phase- to-phase  short  within  the  relay. 

As  a  result  of  this  finding,  on  July  9,  1975,  DAC  notified  all  operators5 6  that  all  cross¬ 
tie  relays  with  more  than  7,000  hours  service  should  be  removed  within  3,000  hours  to  be 
cleaned  and  inspected  per  Westinghouse  Overhaul  Manual  24-20-46,  dated  May  1,  1975.  On 
July  1,  1975,  Westinghouse  issued  Service  Bulletin  (SB)  75-701  to  incorporate  a  more  flame- 
resistant  Lexan  relay  cover  and  improve  the  relay’s  internal  wiring  clearances.  In  March 
1976,  Westinghouse  issued  SB  75-703  to  add  a  gasket  seal  to  each  of  the  interphase  barriers  of 
the  contact  housing  and  change  the  power  relay  assembly  P/N  from  914F567-3  to  914F567-4. 
The  P/N  914F567-4  relay  incorporates  the  changes  recommended  in  SBs  75-701  and  75-703. 
Westinghouse  informed  operators  that  the  reason  for  the  change  was  to  prevent  phase-to-phase 
shorts  resulting  from  the  migration  of  main  contact  wear  products  through  the  contact  housing 
interphase  barriers.  This  modification  was  specifically  recommended  for  all  cross-tie  relays. 
In  June  1977,  Westinghouse  revised  SB  75-703  to  recommend,  for  the  advantages  of 
interchangeability,  that  this  modification  also  be  accomplished  on  all  GRs,  APRs,  and  EPRs. 

On  May  5,  1976,  DAC  issued  All  Operators  Letter  (AOL)  9-977  to  recommend  that  all 
model  DC-9,  C-9A,  and  C-9B  aircraft  cross-tie  relays  be  modified,  in  accordance  with  the  two 
Westinghouse  SBs,  within  6,000  flight  hours.  The  letter  also  informed  operators  that 
beginning  with  aircraft  fuselage  No.  850,  subsequent  production  would  have  the  improved 
power  relay  (P/N  914F567-4)  installed  in  all  seven  relay  positions. 

On  June  25,  1985,  McDonnell  Douglas*  (MD)  issued  AOL  9-1120A  to  advise 
operators  that  Westinghouse  had  developed  an  improved  hybrid  power  relay,  P/N  9008D09, 
which  incorporated  a  deep  cavity  arc  box  and  utilized  magnetically  held  contacts,  in  lieu  of  the 
mechanically  latched  type  formerly  used  by  DAC.  The  design  increased  the  recommended 
time  between  overhaul  (TBO)  to  12,000  flight  hours,  compared  to  the  recommended  TBO  of 
7,000  flight  hours  for  the  P/N  914F567-3  and  -4  relays.  On  November  12,  1991,  MD  issued 
AOL  9-1120B  to  clarify  the  interchangeability  between  the  old  and  new  relay  P/Ns.  The 
operators  were  advised  that  the  new  relay,  P/N  9008D09-X,  was  interchangeable  with  relay 
P/N  914F567-X,  in  all  seven  power  relay  positions  on  all  DC-9  and  MD-80  aircraft.  The 


4  Now  Boeing,  Douglas  Products  Division. 

5  Telex  DC-9-COM-3 1/HRG,  dated  July  9, 1975. 

6  Now  Boeing,  Douglas  Products  Division. 
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letter  also  informed  operators  that  the  improved  power  relays  would  be  installed  at  all  seven 
relay  positions  during  production  for  MD-80  aircraft,  beginning  with  fuselage  No.  909,  and 
for  all  other  DC-9  aircraft,  beginning  with  fuselage  No.  930. 

A  review  of  FAA  service  difficulty  report  (SDR)  data  for  the  period  between 
January  1,  1974,  and  June  1,  1998,  for  Westinghouse  relay  P/Ns  914F567-3  and  914F567-4, 
indicated  21  reported  failures.  Numerous  failures  of  the  relay  resulted  in  electrical  power  loss, 
smoke,  and  unscheduled  landings.  Many  of  the  failures  occurred  in  relays  installed  in 
positions  other  than  the  cross-tie  location.  The  SDR  data  further  revealed  that  several  of  the  -3 
and  -4  relays  had  accumulated  more  than  7,000  flight  hours  at  the  time  of  failure,  thereby 
exceeding  the  recommended  TBO  of  7,000  flight  hours  specified  for  these  relays.  One  SDR, 
submitted  in  1988,  revealed  that  the  operator  had  continued  to  utilize  the  P/N  914F567-3  relay 
in  the  cross-tie  position  subsequent  to  the  1976  issuance  of  DAC  AOL  9-977. 

Based  on  the  February  20,  1997,  NWA  incident  and  the  continued  reports  of  AC  power 
relay  failures,  the  Safety  Board  is  concerned  about  the  ongoing  potential  for  an  electrical  fire 
in  the  DC-9  series  aircraft.  This  potential  can  be  reduced  by  the  modification  of  all  existing 
P/N  914F567-3  relays  to  the  -4  configuration  and  overhaul  of  the  relays  every  7,000  flight 
hours,  before  contaminants  build  to  a  level  that  will  cause  shorting  between  the  main  contacts 
of  the  power  relay,  or  by  their  replacement  with  P/N  9008D09  relays.  Therefore,  the  Safety 
Board  believes  that  the  FAA  should  issue  an  airworthiness  directive  to  require  that  DC-9 
operators  modify  all  existing  Westinghouse  P/N  914F567-3  AC  power  relays  (i.e.  cross-tie 
relays,  GRs,  APRs,  and  EPRs)  to  the  -4  configuration,  in  accordance  with  DAC  AOL  9-977, 
dated  May  5,  1976,  and  overhaul  the  relays  every  7,000  flight  hours  thereafter  or  replace  these 
relays  with  the  improved  power  relay,  P/N  9008D09. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Issue  an  airworthiness  directive  to  require  that  DC-9  operators  modify  all 
existing  Westinghouse  part  number  (P/N)  914F567-3  alternating  current  power 
relays  (i.e.  cross-tie  relays,  generator  relays,  auxiliary  power  relays,  and 
external  power  relays)  to  the  -4  configuration,  in  accordance  with  Douglas 
Aircraft  Company  All  Operators  Letter  9-977,  dated  May  5,  1976,  and  overhaul 
the  relays  every  7,000  flight  hours  thereafter  or  replace  these  relays  with  the 
improved  power  relay,  P/N  9008D09.  (A-98-111) 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMIDT, 
GOGLIA,  and  BLACK  concurred  in  this  recommendation. 


National  Transportation  Safety  Board 

ttSfi!Vf  Washington,  D.C.  20594 

^jvbo^  Safety  Recommendation 


Date:  November  4,  1998 

In  reply  refer  to:  A-98-112 


Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  March  15,  1997,  a  Piper  PA-31  airplane,  operated  by  Cape  Smythe  Air  Service  as 
a  scheduled  commuter  flight  from  Kivalina,  Alaska,  to  Kotzebue,  Alaska,  landed  with  the  left 
main  landing  gear  (MLG)  partially  retracted  at  the  Kotzebue  Airport.  None  of  the  occupants 
was  injured,  and  the  airplane  sustained  minor  damage. 

Before  landing,  the  pilot  attempted  to  lower  the  landing  gear;  however,  the  landing 
gear  did  not  extend  normally,  and  the  landing  gear  unsafe  light  illuminated  in  the  cockpit. 
During  a  subsequent  low  pass  over  the  airfield,  ground  personnel  confirmed  that  the  left  MLG 
was  not  extended.  Postincident  examination  revealed  that  a  forward  hinge  on  the  left  MLG 
inboard  door  had  broken  and  disabled  the  door,  preventing  the  gear  from  extending  fully. 

The  PA-31  MLG  inboard  door  is  configured  with  two  hinge  assemblies  that  attach  the 
door  to  the  airplane,  allowing  the  door  to  open  during  gear  extension.  There  are  two  MLG 
inboard  door  hinge  assemblies  made  for  the  PA-31:  the  original  equipment  hinge  assembly 
(Piper  part  number  (P/N)  46653-00)  and  an  improved  (thicker)  hinge  assembly  (Piper  P/N 
47529-32).  The  improved  hinge  assembly  consists  of  a  0.44-inch-thick,  aluminum-forged 
hinge  with  two  attachment  angles. 

The  airplane  had  been  operated  for  13,988  hours  in  17  years  and  6  months  of  service 
and  had  been  retrofitted  with  the  improved  hinge  assemblies  in  1988.  The  airplane  had 
operated  approximately  9,938  hours  with  the  improved  hinge  assemblies  before  the  hinge 
failure. 


The  National  Transportation  Safety  Board’s  materials  laboratory  examined  the  fracture 
surfaces  of  the  broken  hinge.  The  examination  revealed  a  fatigue  crack  that  had  emanated 
from  multiple  origins  at  the  tip  of  the  forged  flash1  on  the  inside  curve  portion  of  the  hinge 

1  Excess  metal  that  is  forced  out  during  the  forging  operation,  between  the  upper  and  lower  forging  dies. 
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arm  (see  figure  1).  The  arm  is  subjected  to  cyclic  loading  during  service,  and  the  forging  flash 
is  a  high-stress  region  of  the  hinge. 


GEAR  DOOR  HINGE 


INBOARD  MAIN  LANDING 
GEAR  DOOR 


HINGE  ARM 


DOOR  AND  HINGE  ASSEMBLY 


FATIGUE  CRACK  ORIGINATION  AREA 


HINGE  DETAIL 


Figure  1.  Piper  PA-31  Main  Landing  Gear  Door  Assembly 

In  1980,  following  several  incidents  of  fatigue  cracks  in  the  original  hinge,  Piper 
Aircraft  Corporation  (now  New  Piper  Aircraft,  Inc.)  issued  Service  Bulletin  (SB)  682,  which 
recommends  inspection  of  the  PA-31  MLG  inboard  door  hinge  assemblies  and  hinge 
attachment  angles  for  cracks  within  the  first  100  hours  of  operation  or  during  the  next 
scheduled  inspection,  whichever  occurs  first,  and  every  100  hours  thereafter  unless/until  an 
acceptable  replacement  part  is  installed.  The  SB  recommends  that  all  cracked  door  hinges  be 
replaced  with  the  improved  P/N  47529-32  hinge  assemblies  before  further  flight.  Upon 
installation  of  the  improved  hinge  assembly,  repetitive  inspection  of  the  hinge  assembly  is  not 
required.  On  December  19,  1980,  the  Federal  Aviation  Administration  (FAA)  issued 
Airworthiness  Directive  80-26-05,  mandating  the  actions  specified  in  this  SB. 

However,  despite  these  inspection  and  replacement  procedures,  service  difficulty 
reports  (SDR)  indicate  that  since  1980  there  have  been  at  least  17  cracked  or  failed  P/N 
47529-32  hinge  assemblies.  Because  experience  has  shown  that  the  SDR  system  frequently 
underreports  service  failures,  it  is  very  likely  that  there  have  been  other  unreported  events 
involving  P/N  47529-32  hinge  assembly  failures.  For  example,  the  Safety  Board’s  materials 
laboratory  has  examined  another  P/N  47529-32  hinge  that  separated  because  of  fatigue 
cracking  but  there  was  no  SDR  report  of  the  incident. 

The  Safety  Board  is  concerned  that  the  improved  P/N  47529-32,  PA-31  MLG  inboard 
door  hinge  assemblies  are  failing  and  that  no  requirement  exists  for  their  recurrent  inspection. 
Piper  has  indicated  its  intent  to  design  a  new  sheet-metal  hinge  assembly  that  will  replace  the 
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P/N  47529-32  hinge  assembly  to  preclude  further  failures.  Therefore,  the  Safety  Board 
believes  that  the  FAA  should  require  PA-31  operators  to  conduct  repetitive  inspections  for 
cracks  of  all  Piper  P/N  47529-32  MLG  inboard  door  hinge  assemblies  until  they  are  replaced 
by  an  improved  MLG  inboard  door  hinge  assembly  that  is  not  prone  to  similar  failures. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Require  Piper  PA-31  operators  to  conduct  repetitive  inspections  for  cracks 
of  all  Piper  part  number  47529-32  main  landing  gear  (MLG)  inboard  door 
hinge  assemblies  until  they  are  replaced  by  an  improved  MLG  inboard  door 
hinge  assembly  that  is  not  prone  to  similar  failures.  (A-98-112) 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMIDT, 
GOGLIA,  and  BLACK  concurred  in  this  recommendation. 


r* 


National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  October  26,  1998 

In  reply  refer  to:  A-98-1 13  through  -118 


Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  June  18,  1998,  a  Swearingen  SA226-TC  Metroliner  H  airplane,1  Canadian  registry 
C-GQAL,  operated  by  PropAir,  Inc.,  crashed  after  the  left  wing  separated  during  an  attempted 
emergency  landing  at  Mirabel  Airport,  Montreal,  Quebec,  Canada.  The  flight  was  operating  as  a 
charter  from  Montreal  to  Peterborough,  Ontario,  Canada.  The  airplane  had  departed  from 
Montreal’s  Dorval  Airport  and  was  climbing  through  12,500  feet  when  the  flightcrew  reported  a 
loss  of  hydraulic  pressure  and  a  fire  on  the  left  side  of  the  airplane.  The  pilot  then  shut  down  the 
left  engine  and  declared  an  emergency.  The  flightcrew  lost  control  of  the  airplane  at  low  altitude 
during  the  final  approach  for  landing.  The  airplane  was  destroyed,  and  the  two  flightcrew 
members  and  all  nine  passengers  were  killed. 


The  National  Transportation  Safety  Board  is  participating  in  the  Transportation  Safety 
Board  (TSB)  of  Canada’s  ongoing  investigation  under  the  provisions  of  Annex  13  to  the 
Convention  on  International  Civil  Aviation.  On  the  basis  of  the  preliminary  findings  of  the 
investigation,  the  Safety  Board  has  concluded  that  the  Federal  Aviation  Administration  (FAA) 
should  address  several  safety  issues. 

The  airplane  involved  in  the  Montreal  accident  was  equipped  with  B.F.  Goodrich  part 
number  (P/N)  2-1203  wheel  brake  assemblies  (see  figure  1)  2  The  left  wheel  well  included  the 


Swearingen  Aviation  Corporation  was  the  original  manufacturer  of  S A226  and  SA227  series  airplanes.  Fairchild 
Aircraft,  Inc.,  subsequently  acquired  Swearingen  and  continued  the  production  of  these  airplanes. 

The  B.F.  Goodrich  P/N  2-1203  series  brake  assembly  is  a  floating-type,  single-disk  assembly.  The  steel  disk  has 
smooth  sides,  expansion  slots,  and  tangs  around  the  outer  diameter.  The  tangs  are  keyed  into  the  wheel  so  that 
both  rotate  together.  The  disk  floats  in  and  out  of  the  wheel  to  prevent  binding  during  brake  application.  The  cast- 
aluminum  alloy  housing,  which  is  bolted  to  the  landing  gear  stmt,  has  six  cylinders,  aluminum  alloy  pistons,  and 
O-rings  to  prevent  leakage.  Each  piston  is  protected  from  the  brake  pad  by  an  asbestos  piston  insulator  to 
minimize  heat  transfer  from  the  disk  to  the  piston.  During  brake  application,  hydraulic  fluid  is  forced  into  the 
cylinder,  and  the  piston  pushes  against  the  insulator,  movable  brake  pad,  disk,  and  opposing  brake  pad  and  torque 
plate  to  clamp  the  rotating  disk.  The  aiiplane  involved  in  the  Montreal  accident  had  the  original  design 
F/N  2-1203  wheel  brake  assembly.  Subsequent  P/N  2-1203  brake  assemblies  have  suffixes  of -1  through  -4. 
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hydraulic  power  pack,  a  main  landing  gear  (MLG)  assembly,  aluminum  fuel  and  hydraulic  lines 
and  fittings,  an  overheat  sensor,  and  a  rubber  fuel  crossover  line.  The  overheat  sensor  illuminates 
the  L  WING  OVHT  (left  wing  overheat)  warning  light  on  the  pilot’s  annunciator  panel  when 
temperatures  in  the  wheel  well  reach  350°F.3  Although  the  heavier  Fairchild/Swearingen  model 
SA227  airplanes  (and  other  commuter  and  corporate  airplanes  of  the  approximate  weight) 
incorporate  in  the  MLG  wheels  fuse  plugs  that  melt  when  hot,  causing  a  gradual  release  of 
nitrogen  pressure  and  preventing  a  tire  burst,  the  SA226  does  not  incorporate  such  fuse  plugs. 


Piston  Brake  Pads 

Figure  1.  B.F.  Goodrich  2-1203  Disk  Brake  Assembly 


The  preliminary  results  of  the  investigation  revealed  that,  during  the  takeoff  roll,  the 
flightcrew  applied  the  right  rudder  because  the  airplane  was  apparently  veering  toward  the  left 
side  of  the  runway.  Approximately  13  minutes  after  takeoff,  the  flightcrew  noted  a  loss  of 
hydraulic  pressure  and  the  illumination  of  multiple  warning  lights,  including  the  left  wing  overheat 
warning  light.  Meanwhile,  a  passenger  reported  that  the  left  engine  was  on  fire.  The  captain  later 
reported  that  the  fire  was  extinguished  and  that  the  back  of  the  engine  appeared  to  have  exploded. 
However,  while  executing  the  instrument  approach,  approximately  1  minute  before  impact,  the 
flightcrew  reported  that  the  fire  had  resumed.  The  flightcrew  manually  extended  the  landing  gear 
after  descending  through  1,000  feet,  shortly  before  the  left  wing  failed. 

Examination  of  the  wreckage  at  TSB’s  facility  in  Ottawa  revealed  extensive  fire  damage  to 
the  left  MLG  wheel  well,  overheated  left  MLG  brake  assemblies,  burned  tires,  melted  aluminum 


3  A  similar  sensor  is  installed  in  the  right  wheel  well. 
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hydraulic  and  fuel  lines  and  fittings,  and  a  burned  rubber  fuel  crossover  line.  Witness  marks  on 
the  inside  of  the  brake  cylinders  and  on  the  outside  of  the  piston  insulators  indicated  that  the 
pistons  were  cocked  within  their  respective  cylinders.  Most  of  the  brake  pads  were  worn 
unevenly,  exposing  the  base  metal.  The  piston  insulators  and  brake  disks  were  also  worn 
unevenly;  however,  the  wear  on  the  disks  was  within  the  minimum  thickness  requirements 
specified  in  the  airplane’s  maintenance  manual.  Although  the  airplane’s  main  and  brake  hydraulic 
systems  had  a  placard  specifying  MIL-H-83282,  analysis  of  the  fluid  in  both  systems  revealed  a 
mixture  of  MIL-H-83282  and  MIL-H-5606  hydraulic  fluids.4  The  mixed  fluids  had  a  flash  point 
of  approximately  237°F. 

The  investigation  thus  far  indicates  that  the  flightcrew  applied  the  right  rudder  during  the 
takeoff  roll  probably  to  compensate  for  a  dragging  left  wheel  brake  and  then  raised  the  landing 
gear,  with  overheated  brakes,  into  the  left  wheel  well.  Although  the  precise  cause  of  the  wheel 
well  fire  has  not  yet  been  determined,  the  investigative  findings  indicate  that  the  ensuing  fire  in  the 
left  wheel  well  may  have  been  caused  by  either  (1)  leaking  low  flash  point  brake  system  hydraulic 
fluid  from  a  brake  cylinder  or  (2)  leaking  fluid  from  damaged  lines  in  the  wheel  well  from  an 
exploding  tire  coming  in  contact  with  and  being  ignited  by  the  hot  brake  disk.  The  fire  became 
hotter  as  additional  flammable  liquids  from  the  brake,  hydraulic,  and  fuel  systems  were 
introduced.  This  fire  likely  led  to  the  wing  failure.  Leaking  brake  cylinders  could  have  been  caused 
by  the  cocked  pistons,  which  appear  to  have  resulted  from  the  combined  effects  of  excessive  and 
uneven  brake  pad  wear,  uneven  disk  wear,  and  unevenly  worn  piston  insulators  on  the  outboard 
brake. 

Use  of  Lower  Flash  Point  Hydraulic  Fluid 

The  accident  and  incident  history  of  Fairchild/Swearingen  SA226  and  SA227  series 
airplanes  revealed  two  previous  cockpit  fire  accidents  that  involved  the  lower  flash  point 
MIL-H-5606  hydraulic  fluid.  On  October  15,  1982,  a  Sun  Aire  Swearingen  SA226-TC 
Metroliner  n  caught  fire  in  Palm  Springs,  California,  when  an  electrical  arc  from  the  copilot’s 
panel  light  rheostat  ignited  wires,  contaminated  with  hydraulic  fluid  from  the  right  brake  line, 
underneath  the  side  panel.  Additionally,  on  August  27,  1983,  a  Scheduled  Skyways  Swearingen 
SA226-TC  Metroliner  II  caught  fire  in  Hot  Springs,  Arkansas,  when  an  electrical  arc  ignited 
wires,  contaminated  with  hydraulic  fluid,  underneath  the  instrument  panel.5 

After  the  investigations  of  these  two  accidents,  the  Safety  Board  issued  Safety 
Recommendation  A-83-59,  which  asked  the  FAA  to  require  operators  to  comply  with  Fairchild 
Service  Bulletin  (SB)  32-018  and  use  fire-retardant  hydraulic  fluid.  As  a  result,  the  FAA  issued 
Airworthiness  Directive  (AD)  83-19-02  on  September  29,  1983, 6  which  required  operators  of 


4  According  to  Air  Force  Aero  Propulsion  Laboratory  Report  AFAPL-TR-85-2057,  MIL-H-5606  is  a  mineral  oil 
product  with  a  flash  point  of  approximately  194°F,  and  MIL-H-83282  is  a  synthetic  hydrocarbon  with  a  flash  point 
of  approximately  390°F.  Although  the  fluids  are  chemically  compatible,  mixing  MIL-H-83282  with  as  little  as  5 
percent  of  MIL-H-5606  can  render  the  first  fluid’s  fire-retardant  feature  ineffective. 

5  For  more  detailed  information  on  these  two  accidents,  see  Briefs  of  Accident  DCA83AA037  and  LAX83FA002 
(enclosed). 

A  similar  directive  was  issued  by  the  Canadian  government’s  aviation  regulatory  authority,  Transport  Canada. 
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certain  Swearingen  SA226  series  airplanes,  including  the  airplane  involved  in  the  accident  in 
Montreal,  to  drain  and  purge  the  main  hydraulic  and  brake  system  reservoirs  and  refill  them  with 
MIL-H-83282  hydraulic  fluid. 7  The  AD  also  required  that  operators  change  the  placards  on  both 
reservoirs  to  specify  that  only  MIL-H-83282  fluid  be  used.  On  February  21,  1984,  the  Safety 
Board  classified  this  recommendation  “Closed — Acceptable  Action.” 

Although  AD  83-19-02  and  Fairchild’s  airplane  maintenance  manual  required  the  use  of 
MIL-H-83282  hydraulic  fluid  in  the  main  and  brake  hydraulic  systems  in  Swearingen  SA226  and 
SA227  series  airplanes,  respectively,  the  Safety  Board  is  concerned  that  the  use  of  the  lower  flash 
point  MIL-H-5606  or  the  mixing  of  MIL-H-5606  with  MDL-H-83282  may  be  occurring. 
Therefore,  the  Safety  Board  believes  that  the  FAA  should  require  principal  maintenance 
inspectors  to  notify  operators  of  Fairchild/Swearingen  SA226  and  SA227  series  airplanes  of  the 
Montreal  accident  and  the  requirement  to  use  only  the  higher  flash  point  MIL-H-83282  hydraulic 
fluid  in  all  B.F.  Goodrich  P/N  2-1203  series  brake  systems. 

Brake  Assembly  Overheating 

The  accident  and  incident  history  of  Fairchild/Swearingen  SA226  and  SA227  series 
airplanes  also  revealed  two  previous  wheel  well  fire  accidents.  On  July  27,  1988,  a  Peninsula 
Arways  Fairchild  SA227-AC  Metroliner  HI  experienced  a  loss  of  hydraulic  pressure,  wheel  well 
and  wing  overheat  indications,  exploded  tires,  and  substantial  fire  damage  in  the  left  wheel  well.8 
The  flightcrew  made  a  successful  emergency  landing  at  Anchorage  International  Arport  in 
Aaska.  Additionally,  on  February  10,  1990,  a  Perimeter  Arlines  Swearingen  SA226-TC 
Metroliner  II  similarly  experienced  a  loss  of  hydraulic  pressure,  wheel  well  and  wing  overheat 
indications,  exploded  tires,  and  substantial  fire  damage  to  the  left  wheel  well.  The  flightcrew  shut 
down  the  left  engine  and  made  a  successful  emergency  landing  at  Winnipeg  International  Arport 
in  Canada.9 

As  a  result  of  its  investigation  into  the  Anchorage  incident,  the  Safety  Board  issued  Safety 
Recommendation  A-89-101,  asking  the  FAA  to  conduct  a  directed  safety  investigation  of  the 
Fairchild  SA226  and  SA227  wheel  braking  systems  that  utilize  the  B.F.  Goodrich  P/N  2-1203-3 
wheel  brake  assembly  to  (1)  determine  the  potential  for  brake  lockups  or  overheating  as  a  result 
of  piston  insulator  cocking  and  (2)  evaluate  the  current  wear  limits  for  proper  brake  operation  at 
the  maximum  wear  allowed.  The  FAA  reviewed  the  5-year  history  of  service  difficulty  reports 
regarding  B.F.  Goodrich  brake  malfunctions  and  discovered  that  75  reports,  including  9  incidents 
of  MLG  brake  or  wheel  well  fires,  had  been  filed.  On  October  26,  1989,  B.F.  Goodrich  issued 
Service  Letter  (SL)  1498  to  clarify  the  proper  location  to  take  wear  measurements  for  all 
P/N  2-1203  series  brake  assemblies  and  revise  the  maximum  allowable  clearance  for  brake 
assembly  P/N  2-1203-3  to  reduce  the  brake  lining  wear  allowed  before  required  overhaul.  The 
FAA  issued  a  special  notice  to  FAA  inspectors  to  alert  them  that  SL  1498  revised  the  method  of 
determining  brake  wear  and  the  brake  wear  limit  for  P/N  2-1203  brake  assemblies,  and  Fairchild 


7  The  Fairchild/Swearingen  SA227  series  airplane  maintenance  manual  already  specified  the  use  of  MIL-H-83282 
in  the  main  and  brake  hydraulic  systems. 

8  For  more  detailed  information,  see  Brief  of  Accident  ANC88FA100  (enclosed). 

9  For  more  detailed  information,  see  Aviation  Occurrence  Report  synopsis  A90C0024  (enclosed). 
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revised  its  maintenance  manual  accordingly.  On  June  18,  1990,  the  Safety  Board  classified  this 
recommendation  “Closed — Acceptable  Action.” 

Also,  the  Safety  Board  issued  Safety  Recommendation  A-89-102,  asking  the  FAA  to  take 
appropriate  action  to  prevent  brake  binding  and  overheating  of  B.F.  Goodrich  P/N  2-1203-3 
brake  assemblies.  On  January  16,  1992,  the  FAA  issued  AD  92-01-02,  which  required  that 
operators  of  SA226  and  SA227  airplanes  equipped  with  B.F.  Goodrich  P/N  2-1203-3  brakes 
inspect  and  conduct  wear  measurements  in  accordance  with  SL  1498  and  that  operators  of  certain 
SA226  and  SA227  airplanes  modify  the  parking  brake  system  in  accordance  with  Fairchild  SBs 
227-32-017  and  226-32-049.10  On  March  24,  1992,  the  Safety  Board  classified  this 
recommendation  “Closed — Acceptable  Action.” 


The  wear  measurement  techniques  specified  in  the  component  maintenance  manual, 
SL  1498,  and  AD  92-01-02  were  intended  to  measure  the  amount  of  brake  wear.  However,  the 
techniques  were  not  designed  to  measure  or  detect  the  degree  of  uneven  wear,  which  could  lead 
to  cocked  pistons  and  result  in  dragging  brakes,  hydraulic  fluid  leakage,  and  wheel  well  fires. 
Therefore,  the  Safety  Board  believes  that  the  FAA  should  require  B.F.  Goodrich  to  develop  and 
implement  a  process  for  identifying  and  eliminating  excessive  uneven  wear  on  all  B.F.  Goodrich 

P/N  2-1203  series  wheel  brake  assemblies  used  on  Fairchild/Swearingen  SA226  and  SA227  series 
airplanes. 

Need  for  Improved  Emergency  Procedures  to  Address  Wheel  Well  Fires 

The  SA226-TC  airplane  flight  manual  (AFM)  states  that,  after  the  illumination  of  a  wing 
overheat  warning  light,  the  flightcrew  should  secure  the  bleed  air  from  the  affected  engine  and 
extend  the  landing  gear.  The  flightcrew  involved  in  the  Montreal  accident  apparently  noticed  a 
loss  of  hydraulic  pressure  and  the  left  wheel  well  and  wing  overheat  warning  light  but  did  not 
extend  the  landing  gear  until  just  before  impact.  In  this  accident,  immediate  extension  of  the 
landing  gear  might  have  prevented  failure  of  the  left  wing. 

The  AFM  emergency  procedure  to  address  the  illumination  of  the  wheel  well  and  wing 
overheat  warning  light  assumes  that  the  cause  is  an  air  conditioning  duct  overheat  and  does  not 
consider  the  consequences  of  a  wheel  well  fire  and  the  loss  of  hydraulic  pressure  or  other  airplane 
systems.  For  example,  the  procedure  calls  for  shutting  down  the  engine  on  the  affected  side  of 
the  airplane,  which  would  be  appropriate  for  an  air  conditioning  duct  overheat  or  a  bleed  air  leak 
but  unnecessary  for  a  brake  fire.  Therefore,  the  Safety  Board  believes  that  the  FAA  should 
require  Fairchild  to  (1)  expand  the  description  of  the  wing  and  wheel  well  overheat  annunciator 
panel  warning  light  in  all  Fairchild/Swearingen  SA226  and  SA227  series  AFMs  to  note  that  a  L  or 
R  WING  OVHT  annunciation  may  indicate  a  brake  or  wheel  well  fire  and  (2)  expand  the 
emergency  procedure  for  a  wheel  well  and  wing  overheat  warning  annunciation  to  address  a 
wheel  well  fire  and  the  consequences  of  other  airplane  system  failures  as  a  result  of  the  fire. 


The  requirement  for  the  parking  brake  system  is  not  relevant  to  the  issues  discussed  in  this  safety 
recommendation  letter.  y 
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The  Safety  Board  is  also  concerned  about  the  vulnerability  of  the  MLG  wheel  well  in  all 
Fairchild/Swearingen  SA226  and  SA227  series  airplanes  to  the  consequences  of  overheated 
brakes  and  wheel  well  fires.  In  the  Montreal  accident,  the  heat  from  the  wheel  well  fire  consumed 
the  rubber  fuel  crossover  line,  melted  aluminum  fuel  and  hydraulic  system  lines  and  fittings,  and 
allowed  flammable  fluid  to  be  introduced  to  the  wheel  well  fire.  In  addition,  the  wheel  well  might 
have  incurred  damage  from  bursting  tires.  A  brake  temperature  monitoring  or  overheat  detection 
system  could  have  provided  the  pilots  with  an  earlier  warning  of  an  overheating  brake.  Also,  the 
introduction  of  flammable  fluids  may  have  been  prevented  had  the  airplane  been  equipped  with 
stainless  steel,  rather  than  aluminum,  hydraulic  and  fuel  lines;  a  heat-resistant  fuel  crossover  line; 
or  fuse  plugs  such  as  those  already  installed  in  the  higher  gross  weight  SA227  series  airplanes. 
Therefore,  the  Safety  Board  believes  that  FAA  should  require  the  modification  of 
Fairchild/Swearingen  SA226  and  SA227  series  airplanes  to  (1)  include  the  installation  of  a  brake 
temperature  monitoring  or  overheat  detection  system;  (2)  provide  protection  to  keep  tires  from 
exploding;  and  (3)  protect  the  lines,  fittings,  and  tubing  installed  in  the  wheel  wells  from  hazards 
associated  with  exploded  tires  and  fire. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Require  principal  maintenance  inspectors  to  notify  operators  of 
Fairchild/Swearingen  SA226  and  SA227  series  airplanes  of  the  Montreal  accident 
and  the  requirement  to  use  only  the  higher  flash  point  MIL-H-83282  hydraulic 
fluid  in  all  B.F.  Goodrich  part  number  2-1203  series  brake  systems.  (A-98-1 13) 

Require  B.F.  Goodrich  to  develop  and  implement  a  process  for  identifying  and 
eliminating  excessive  uneven  wear  on  all  B.F.  Goodrich  part  number  2-1203  series 
wheel  brake  assemblies  used  on  Fairchild/Swearingen  SA226  and  SA227  series 
airplanes.  (A-98-1 14) 

Require  Fairchild  to  (1)  expand  the  description  of  the  wing  and  wheel  well 
overheat  annunciator  panel  warning  light  in  all  Fairchild/Swearingen  SA226  and 
SA227  series  airplane  flight  manuals  to  note  that  a  L  or  R  WING  OVHT 
annunciation  may  indicate  a  brake  or  wheel  well  fire  and  (2)  expand  the  emergency 
procedure  for  a  wheel  well  and  wing  overheat  warning  annunciation  to  address  a 
wheel  well  fire  and  the  consequences  of  other  airplane  system  failures  as  a  result  of 
the  fire.  (A-98-1 15) 

Require  the  modification  of  Fairchild/Swearingen  SA226  and  SA227  series 
airplanes  to 

(1)  include  the  installation  of  a  brake  temperature  monitoring  or 
overheat  detection  system;  (A-98-1 16) 

(2)  provide  protection  to  keep  tires  from  exploding;  (A-98-1 17)  and 
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(3)  protect  the  lines,  fittings,  and  tubing  installed  in  the  wheel  wells  from 
hazards  associated  with  exploded  tires  and  fire.  (A-98-1 18) 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMEDT, 
GOGLIA,  and  BLACK  concurred  in  these  recommendations. 

— By^JtmHall 
Chairman 

Enclosures 


The  National  Transportation  Safety  Board  determines  that  the  Probable  Cause(s)  of  this  accident 
is/are  finding(s)  2,3,4,5,6,7,8,9,10 
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CERTIFICATES/RATINGS  TOTAL  ALL  AIRCRAFT  - 14800 

Airline  transport  LAST  90  DAYS  -  293 

Single-engine  land,  Multiengine  land.  Single-engine  sea  TOTAL  MAKE/MODEL  -  2650 


INSTRUMENT  RATINGS  TOTAL  INSTRUMENT  TIME  -  2841 

Airplane 


FACTORS 


The  Transportation  Safety  Board  of  Canada  (TSB)  investigated  this  occurrence 
for  the  purpose  of  advancing  transportation  safety.  It  is  not  the  function  of 
the  Board  to  assign  fault  or  determine  civil  or  criminal  liability. 
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The  twin-engine  turboprop  aircraft,  with  two  pilots  and  ll  passengers  on 
board,  departed  Winnipeg  International  Airport  on  a  regular  scheduled  flight 
to  island  Lake,  Manitoba.  About  10  minutes  north,  while  the  aircraft  was 
climbing  to  cruise  altitude,  the  hydraulic  system  pressure  started  to  fall. 

The  pilot  advised  Winnipeg  air  traffic  control  that  they  ware  returning  to  the 
airport.  The  left  main  landing  gear  indicator  lights  then  came  on,  showing 
both  in- transit  and  down  and  locked.  The  pilots  heard  two  loud  bangs  from  the 
left  side  of  the  aircraft,  and  the  captain  feathered  the  left  engine.  On 
final  approach,  a  manual  landing  gear  extension  was  completed,  and  the  tower 
controller  advised  the  pilot  that  the  left  landing  gear  was  not  visible,  and 
that  the  left  engine  was  on  fire.  The  pilot  carried  out  an  emergency  landing, 
and  all  the  occupants  evacuated  the  aircraft  safely. 

The  Transportation  Safety  Board  of  Canada  determined  that  an  overheated  left 
inner  brake  ignited  the  left  main  landing  gear  tires,  and  that  the  fire  was 
fuelled  by  a  leaking  fuel  pressure  line  in  the  left  wheel  well. 


National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  November  30,  1998 

In  reply  refer  to:  A-98-1 19  through  -121 


Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  April  11,  1997,  the  pilot  of  a  single-seat  Glaser-Dirks  DG-300  glider,  N70644,  was 
killed  after  he  lost  control  of  the  aircraft  for  undetermined  reasons  and  crashed  near  Minden, 
Nevada.  The  National  Transportation  Safety  Board’s  investigation  found  that  the  pilot  had 
jettisoned  the  glider’s  canopy  in  an  apparent  attempt  to  parachute  from  the  aircraft  but  that  he 
was  subsequently  incapacitated  when  the  canopy  struck  his  forehead  during  the  jettison  sequence 
(the  basis  for  these  findings  is  discussed  later  in  this  letter).  As  a  result,  he  remained  with  the 
aircraft  and  was  found  in  the  cockpit  with  his  seat  belt  restraint  system  still  fastened.  The  nearly 
horizontal  flightpath  of  the  jettisoned  canopy  caused  it  to  strike  the  glider’s  T-tail,  become 
impaled  on  the  horizontal  portion  of  the  T-tail,  and  remain  with  the  aircraft  until  ground  impact. 
The  glider  was  destroyed. 

The  canopy’s  emergency  jettison  release  knob  and  pin-latch  handle  had  both  been  pulled 
in  accordance  with  the  requirements  for  jettisoning  outlined  in  the  DG-300  Pilot’s  Operating 
Handbook.  The  handbook  indicates  that  the  jettisoned  canopy  will  then  be  blown  away  by  the 
oncoming  airsteam. 

In  normal  operation,  the  canopy  is  latched  or  unlatched  at  the  aft  end,  and  the  front  end  of 
the  canopy  pivots  about  an  airframe-mounted  pivot  assembly.  Pulling  the  canopy’s  pin-latch 
handle  withdraws  the  pin  from  the  latch  clevis  and  unlocks  the  canopy  at  the  aft  end.  The 
canopy’s  latching  pin,  on  the  aft  upper  part  of  the  canopy,  and  the  latch  clevis,  on  the  aft  upper 
part  of  the  cockpit,  were  found  intact  and  undamaged.  Pulling  the  jettison  release  knob  unlocks 
the  front  end  pivot  assembly  and  allows  a  small  spring  to  push  the  front  end  of  the  canopy 
upward,  away  from  the  pivot  plate.  The  Safety  Board  found  that  activating  the  release  knob  on 
the  ground  results  in  a  positive  release  of  the  canopy  from  the  pivot  plate.  However,  the  spring 
force  does  not  result  in  significant  upward  travel  of  the  front  end  of  the  canopy  and,  therefore, 
may  be  insufficient  to  ensure  automatic  in-flight  separation  of  the  canopy  from  the  fuselage. 
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The  left  and  right  outboard  horizontal  sections  of  the  glider’s  T-tail  contained  impact 
marks  with  black  paint  smears  similar  to  the  black  paint  on  the  interior  of  the  canopy  frame;  the 
distance  between  the  impact  marks  approximated  the  length  of  the  canopy  frame.  There  were 
several  small  punctures  on  the  upper  surface  of  the  tail;  one  was  round  with  red  material, 
approximating  the  shape  and  color  of  the  jettison  release  knob.  Pieces  of  the  canopy  Plexiglas 
were  found  up  to  300  yards  from  the  glider’s  main  wreckage. 

According  to  the  autopsy  report,  the  pilot’s  face  had  several  large  lacerations  and 
abrasions  with  minimal  associated  hemorrhage.  No  blood  was  observed  anywhere  on  the  pilot’s 
face,  but  the  autopsy  report  described  a  large  bruise  on  the  forehead  as  follows:  “Covering  the 
front  of  the  forehead,  almost  paralleling  the  eyebrows,  is  a  10.0  x  6.0  cm  area  of  confluent 
purple-gray  abrasion  superimposing  contusion.”  This  was  the  only  contusion1  noted  anywhere 
on  the  pilot’s  head.  The  contusion  was  consistent  with  impact  from  a  solid,  hard  object  with  a 
linear  edge.  The  absence  of  bleeding,  despite  large  lacerations  to  the  pilot’s  face,  indicates  that 
his  death  upon  ground  impact  was  abrupt,  resulting  from  blunt  force  trauma. 

The  contusion  (bruise)  on  the  pilot’s  forehead,  however,  required  a  finite  period  of  time 
after  the  trauma  was  inflicted  for  the  injury  to  accumulate  blood.  Moreover,  blood  to  this  area  of 
the  body  could  not  have  resulted  from  gravity  flow  but  had  to  be  provided  under  pressure. 
Therefore,  the  impact  force  causing  the  contusion  had  to  have  been  inflicted  before  the  ground 
impact  that  killed  the  pilot.  This  fact,  together  with  the  shape  and  location  of  the  contusion, 
provides  compelling  evidence  that  the  canopy  frame  struck  the  pilot  on  the  forehead  during  the 
jettison  sequence. 

The  DG-300  is  manufactured  in  Germany  by  DG  Flugzeugbau  GmbH  and  is  type 
certificated  in  that  country  in  the  utility  category,  according  to  Joint  Airworthiness  Requirements 
for  Sailplanes  and  Powered  Sailplanes  (JAR-22).2  However,  the  glider  has  not  been  type 
certificated  in  the  United  States  but  is  currently  imported,  licensed,  and  operated  in  the 
experimental  category.  According  to  the  manufacturer,  jettison  of  the  DG-300  canopy  or  the 
canopies  on  DG-1 00/200/400/600  series  gliders  (aircraft  configured  with  a  similar  canopy  and 
jettison  mechanism)  was  not  required  to  be  demonstrated  during  the  course  of  German 
certification.  However,  the  manufacturer  indicated  that,  during  a  flight  test  of  a  DG-600,  jettison 
of  the  canopy  became  necessary  during  a  spiral  dive  and  was  accomplished  successfully  without 
injury  to  the  pilot. 

Egress  from  the  cockpit  and  jettisoning  of  the  canopy  are  addressed  in  the  following 
excerpts  from  JAR  22.807,  Emergency  Exit: 


1  A  contusion  (bruise)  signifies  hemorrhage  into  the  skin,  the  tissues  under  the  skin,  or  both.  It  is  usually  the  result 
of  a  blow  or  squeeze  that  crushes  the  tissues  and  ruptures  blood  vessels  but  does  not  break  the  skin. 

2  JAR-22  is  based  on  the  Federal  Republic  of  Germany’s  national  airworthiness  code  and  was  developed  through 
the  joint  participation  of  several  European  countries. 
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(a)  The  cockpit  must  be  so  designed  that  unimpeded  and  rapid  escape 
in  emergency  situations  during  flight  and  on  the  ground  is  possible 
with  the  occupant  wearing  a  parachute. 

(b)  The  opening,  and  where  appropriate  jettisoning,  of  each  canopy  or 
emergency  exit  must  not  be  prevented  by  the  presence  of  the 
appropriate  aerodynamic  forces  and/or  the  weight  of  the  canopy  at 
speeds  up  to  Vdf  or  by  jamming  of  the  canopy  with  other  parts  of  the 
sailplane.  The  canopy  or  emergency  exit  attachment  fittings  must  be 
designed  to  permit  easy  jettisoning,  where  jettisoning  is  a  necessary 
feature  of  the  design. 

Until  recently,  all  Glaser-Dirks  gliders  imported  into  the  United  States,  except  for  the 
DG-500  model,  were  certificated  in  the  experimental  category.  However,  the 
DG-100/400/500/800  models  are  now  type  certificated  in  the  standard  (utility)  airworthiness 
category,  and  the  Safety  Board  understands  that  the  Federal  Aviation  Administration  (FAA)  has 
initiated  a  program  aimed  at  eventual  type  certification  of  all  Glaser-Dirks  gliders  in  the  standard 
airworthiness  category.  Even  though  the  Safety  Board  concurs  with  the  FAA’s  certification 
objectives,  it  is  concerned  about  the  extent  to  which  jettison  of  the  canopies  of  these  gliders  has 
been  demonstrated  for  certification  purposes.  Although  the  jettison  of  a  DG-600  canopy  was 
apparently  accomplished  without  incident,  the  Safety  Board  does  not  believe  that  this  single 
event  provides  a  sufficient  technical  basis  for  concluding  that  the  canopy  can  be  jettisoned 
successfully  under  all  conditions  throughout  the  complete  airspeed  and  maneuver  operating 
envelopes  of  these  gliders.  For  example,  flight  at  high  angles  of  attack  or  sideslip,  as  in  a  spin, 
might  significantly  affect  a  canopy’s  jettison  characteristics  and  its  subsequent  flightpath. 

In  connection  with  an  evaluation  of  existing  glider  canopy  jettisoning  systems,  the 
German  Federal  Ministry  of  Transport  commissioned  the  1991  study  “Problems  and 
Improvements  of  Canopy  Jettisoning  Systems”  in  which  tests  were  performed  with  a  glider 
mounted  on  the  roof  of  an  automobile.  Details  were  presented  of  the  motion  and  flightpath  of  the 
canopy,  after  its  release  in  an  emergency,  as  well  as  the  influence  of  airspeed,  angle  of  attack, 
sideslip,  and  raising  of  the  front  end  of  the  canopy.  The  study  concluded  the  following: 

It  is  clear  that  none  of  the  existing  mechanisms  in  today’s  gliders 
guarantee  a  problem-free  jettisoning  of  the  canopy  and  there  is  a  high 
risk  of  injury  to  the  pilot  by  the  moving  canopy.  The  main  reason  for 
this  is  the  nose-down  pitching  and  nose-inwards  yawing  moment  on 
the  canopy.  This  is  due  to  the  position  of  the  center  of  pressure  which 
is  behind  the  center  of  gravity.  This  nose-down  moment  can  be 
transformed  into  a  nose-up  pitching  moment  by  a  rear  hinge  between 
the  top  of  the  canopy  and  the  fuselage.  This  hinge  can  take  the  form 
of  a  simple  clasp.  In  such  cases,  the  hinge  must  be  released  at  an 
angle  of  approximately  40  degrees  between  the  canopy  and  the 
cockpit.  This  simple  improvement  means  that  after  the  release,  the 
canopy  rotates  with  a  nose-up  pitching  moment,  separates  quickly 
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from  the  cockpit  and  passes  high  above  the  rudder.  There  is  no  risk  of 
injury  to  the  pilot. 

An  automatic  jettisoning  assumes  a  raising  of  the  front  part.  At  low 
speeds  and  a  low  angle  of  attack,  the  raising  does  not  initiate  the 
separation  of  the  canopy.  For  this  reason,  there  should  be  two  handles 
on  the  right  and  left  frame  of  the  canopy  which  the  pilot  can  use  to 
assist  jettisoning.  These  handles  should  also  be  used  to  release  the 
canopy.  This  is  why  there  should  be  two  handles  in  any  canopy 
jettisoning  system. 

The  relatively  shallow,  almost  horizontal  flightpath  of  the  jettisoned  canopy  from 
N70644,  causing  it  to  strike  both  the  pilot  and  the  glider’s  T-tail,  contrasts  sharply  with  the 
study’s  test  results  based  on  a  canopy  with  a  rear  hinge  that  releases  from  the  cockpit  at  about 
40°.  For  example,  in  one  such  test  conducted  at  70  knots,  the  canopy  rotated  upward  around  the 
hinge,  separated  from  the  fuselage  at  the  proper  angle,  ascended  steeply,  and  passed  over  the 
glider’s  tail  at  a  height  of  about  13  feet. 

There  are  about  88  aircraft  of  the  DG-300/400/500/600/800  series  currently  operating  in 
the  United  States.  The  Safety  Board  believes,  based  on  the  FAA’s  program  to  eventually 
certificate  all  Glaser-Dirks  gliders  in  the  standard  airworthiness  category,  that  the  models  and 
their  numbers  may  increase  significantly.  Therefore,  the  Safety  Board  believes  that  the  FAA 
should  require  DG  Flugzeugbau  GmbH  to  conduct  testing  of  the  canopy  jettison  system  used  on 
all  Glaser-Dirks  gliders  certificated  in  the  United  States  to  determine  the  design  changes, 
conditions,  or  limitations  necessary  to  ensure  that  the  canopies  can  be  reliably  jettisoned 
throughout  the  airspeed  and  maneuver  operating  envelopes  of  the  aircraft  without  striking  the 
pilot.  The  Safety  Board  also  believes  that  the  FAA  should  issue  an  airworthiness  directive, 
applicable  to  all  Glaser-Dirks  gliders  certificated  in  the  United  States  in  the  standard 
airworthiness  category,  requiring  the  implementation  of  any  appropriate  design  changes  and/or 
operational  procedures.  Further,  The  Board  believes  that  the  FAA  should  issue  a  special 
airworthiness  information  bulletin,  applicable  to  all  Glaser-Dirks  gliders  certificated  in  the 
United  States  in  the  special  (experimental)  airworthiness  category,  advising  owners  of  the  need 
to  implement  any  appropriate  design  changes  and/or  operational  procedures. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Require  DG  Flugzeugbau  GmbH  to  conduct  testing  of  the  canopy 
jettison  system  used  on  all  Glaser-Dirks  gliders  certificated  in  the 
United  States  to  determine  the  design  changes,  conditions,  or 
limitations  necessary  to  ensure  that  the  canopies  can  be  reliably 
jettisoned  throughout  the  airspeed  and  maneuver  operating  envelopes 
of  the  aircraft  without  striking  the  pilot.  (A-98-1 19) 
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Issue  an  airworthiness  directive,  applicable  to  all  Glaser-Dirks  gliders 
certificated  in  the  United  States  in  the  standard  airworthiness 
category,  requiring  the  implementation  of  any  appropriate  design 
changes  and/or  operational  procedures.  (A-98-120) 

Issue  a  special  airworthiness  information  bulletin,  applicable  to  all 
Glaser-Dirks  gliders  certificated  in  the  United  States  in  the  special 
(experimental)  airworthiness  category,  advising  owners  of  the  need  to 
implement  any  appropriate  design  changes  and/or  operational 
procedures.  (A-98-121). 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMEDT, 
GOGLIA,  and  BLACK  concurred  in  these  recommendations. 


National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  November  30,  1998 

In  reply  refer  to:  A-98-122  through  -124 


Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  June  2,  1998,  a  Boeing  757-232  (B-757),  N629DL,  owned  and  operated  by  Delta 
Airlines,  Inc.,  was  damaged  when  its  left  off-wing  emergency  evacuation  slide  separated  from  the 
airplane  during  a  scheduled  flight  operated  under  Title  14  Code  of  Federal  Regulations  Part  121 
en  route  from  LaGuardia  Airport  (LGA)  to  Cincinnati/Northem  Kentucky  International  Airport 
(CVG).  The  pilot  reported  that  during  climbout  from  LGA  he  noticed  the  engine  indication  and 
crew  alerting  system  (EICAS)  light  illuminate,  indicating  that  the  left  off-wing  slide  door  was 
open.  The  flight  continued  to  CVG  and  landed  without  further  incident.  None  of  the  occupants 
were  injured. 

After  the  airplane  landed,  a  Delta  Airlines  mechanic  performed  a  walk-around  inspection. 
During  the  inspection  he  saw  that  the  left  off-wing  emergency  escape  slide  had  separated  from  the 
airplane,  the  left  side  of  the  fuselage  aft  of  the  slide  was  damaged,  the  slide  was  missing,  and  the 
restraining  hook  that  mounted  to  the  slide  platform  was  broken,  which  allowed  the  platform  to 
over-rotate,  causing  damage  to  the  wing  and  fuselage  (see  figure  1).  The  slide  carrier,  the 
platform,  and  the  door  latching  tube  remained  with  the  airplane.  Further  inspection  found 
significant  damage  to  the  left  side  of  the  fuselage  aft  of  the  trading  edge  of  the  left  inboard  flap. 

During  its  investigation  of  the  B-757  off-wing  escape  slide,  the  National  Transportation 
Safety  Board  found  that  Delta  Airlines  had  performed  a  replacement  of  the  left  off-wing 
emergency  escape  slide  2  days  before  the  incident.  The  two  mechanics  who  replaced  the  slide 
stated  that  it  was  the  first  time  they  had  replaced  a  B-757  off- wing  slide.  The  mechanics  stated 
that  they  referred  to  the  B-757  maintenance  manual,  sections  25-65-00  and  25-65-01,  and  the 
placard  on  the  inside  of  the  maintenance  access  door  while  they  replaced  the  slide.1  One  mechanic 
maneuvered  the  round  yellow  actuator  handle  that  secures  the  off-wing  emergency  slide  door 
within  the  slide  compartment  (see  figure  2),  and  the  other  mechanic  held  the  slide  door  closed  (by 
sitting  on  the  wing  and  pressing  on  the  door  with  both  his  feet.)  The  mechanic  who  manipulated 
the  round  yellow  actuator  handle  said  it  was  difficult  to  ensure  that  the  handle  was  in  the  full- 


1  Section  25-65-00  describes  the  operation  of  the  B-757  off-wing  escape  system,  and  25-65-01  describes  the 
removal/installation  of  the  B-757  off- wing  escape  slide  pack. 


7077 


2 


down  position,  stating  that  “it  took  several  attempts  to  move  the  actuator  handle  to  the  latched 
position.”  The  mechanics  stated  that  after  the  door  was  latched  one  mechanic  ran  his  finger 
around  the  door  to  ensure  it  was  closed,  and  then  both  mechanics  checked  the  EICAS  in  the 
cockpit  to  ensure  that  the  door  was  closed.  One  of  the  two  mechanics  said  that  he  had  received 
instructions  on  how  to  replace  the  slide  about  4  or  5  years  ago  during  a  2-week  B-757  initial 
maintenance  training  class  that  provided  instructions  on  all  B-757  systems.  The  other  mechanic 
had  not  yet  received  training  on  the  B-757  off-wing  escape  slide  replacement  during  his  3  months 
of  employment  at  Delta. 


Slide  Compartment 

Off-Wing  Escape  Slide  Door 

inside  of  Slide  Pack  \  _ _ 


Tube 

fwdcj 


© 


Figure  1. — B-757  Off-Wing  Escape  Slide  Assembly 
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YELLOW  CRANK  HANDLE 


CARRIER  IN 
LOCKED  POSITION 


Figure  2. — B-757  Off-Wing  Escape  Slide  Actuator  Assembly 


Previous  In-flight  Separations  of  Off- Wing  Emergency  Escape  Slides 

On  October  16,  1997,  a  B-757,  operated  by  United  Airlines,  Inc.,  was  damaged  when  its 
left  off-wing  emergency  evacuation  slide  separated  from  the  airplane  during  a  scheduled  flight  en 
route  from  Seattle,  Washington,  to  Denver,  Colorado.  The  captain  stated  to  Safety  Board 
investigators  that  as  the  airplane  was  rotated  for  liftoff,  he  noticed  the  EICAS  light  illuminate, 
indicating  that  the  left  wing  slide  door  was  open.  The  flight  continued  to  Denver  International 
Airport  (DIA),  and  during  its  descent  for  landing,  a  flight  attendant  who  was  in  the  midcabin 
heard  a  loud  noise  on  the  left  side  of  the  airplane.  The  airplane  landed  without  further  incident  at 
DIA,  and  none  of  the  occupants  were  injured. 

The  Safety  Board’s  investigation  found  that  United  had  performed  a  routine  replacement 
of  the  left  off-wing  emergency  escape  slide  the  evening  before  the  incident.  One  of  the  two 
mechanics  who  replaced  the  slide  that  evening  stated  that  it  was  only  the  second  time  in  his  12- 
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year  career  with  the  airline  that  he  had  replaced  a  B-757  off- wing  slide.  He  had  replaced  the  first 
slide  about  10  years  earlier.  The  mechanic  stated  that  when  he  replaced  the  slide  the  night  before 
the  incident,  he  had  been  outdoors  (on  the  ramp)  using  a  flashlight  and  had  referred  to  the  B-757 
maintenance  manual.  The  mechanic  stated  that  he  was  not  aware  that  there  were  instructions 
(which  indicated  the  proper  positioning  of  the  yellow  actuator  handle  that  secured  the  off-wing 
emergency  slide  door  within  the  slide  compartment)  on  a  placard  inside  the  maintenance  access 
door.  The  mechanic  also  stated  that  he  had  not  received  any  formal  training  from  Boeing  or  from 
United  for  installing  the  off-wing  escape  slide  system  and  that  he  relied  solely  on  the 
B-757  maintenance  manual.  The  other  mechanic  stated  that  this  was  the  first  time  that  he  had 
replaced  a  B-757  off- wing  escape  slide.  He  said  that  he  had  not  received  training  on  the  B-757 
off-wing  escape  slide  replacement  during  his  1 1  years  of  employment  at  United. 

On  June  8,  1993,  a  B-757  left  off- wing  emergency  escape  slide  deployed  while  United 
Airlines  flight  382  was  climbing  through  flight  level  250.  The  captain  heard  an  “explosive  noise” 
followed  by  the  airplane  rolling  sharply  to  the  left.2  The  flightcrew  declared  an  emergency  and 
made  an  uneventful  landing  at  Los  Angeles  International  Airport,  Los  Angeles,  California.  A 
postincident  inspection  found  that  the  left  off-wing  escape  slide  had  deployed  and  had  separated 
(at  an  unknown  time)  in  flight.  The  Safety  Board’s  investigation  of  the  incident  found  that  United 
had  performed  maintenance  on  the  left  off-wing  escape  slide  before  the  flight. 

Information  on  Servicing  and  Replacing  the  Off-Wing  Emergency  Escape  Slide 

The  B-757  off- wing  emergency  escape  slide  system  is  located  just  above  the  trailing  edge 
of  each  wing  in  the  aft  wing/body  fairing  and  consists  of  a  ramp/slide  folded  into  a  “slide  pack” 
attached  to  a  packboard  and  installed  on  a  carrier  assembly.  To  service  the  slide,  a  mechanic  must 
first  open  the  slide  maintenance  access  door  and  release  the  trigger  on  a  round  yellow  handle.  The 
yellow  handle  actuates  a  pneumatic  actuator,  which  unlatches  the  slide  compartment  door.  The 
slide  compartment  door  is  locked  in  the  closed  position  by  lowering  the  yellow  handle  to  its 
lowest  position;  this  secures  the  door  latch  tube  that  is  located  along  the  lower  edge  of  the  slide 
compartment  (see  figure  2).  A  door  sensor  (micro  switch)  located  on  the  aft  edge  of  the  door  sill 
activates  the  “EMER  DOORS”  light  on  the  cockpit  overhead  annunciator  panel  and  displays  the 
“L  WING  SLIDE”  or  “R  WING  SLIDE”  EICAS  message  if  either  off-wing  slide  door  opens 
more  than  0.24  inch  at  its  sensor  switch. 

Replacement  of  the  slide  requires  that  a  mechanic  remove  the  main  landing  gear  wheel 
well  access  cover  located  directly  beneath  the  slide  carrier  compartment  to  remove  the  bolts  that 
secure  the  slide  pack  to  the  carrier.  Also,  the  carrier  has  a  locking  pin  that  can  only  be  viewed  by 
a  mechanic  from  the  lower  wheel  well.  When  the  slide’s  carrier  is  fully  locked  in  place  and  the 
yellow  crank  handle  is  moved  to  the  down  and  locked  position,  the  locking  pin  should  be  fully 
engaged  in  the  carrier’s  locking  lug.  The  maintenance  manual  provides  step-by-step  guidance  for 
the  removal  and  installation  of  the  B-757  off-wing  emergency  escape  slide,  and  section  25-65-09 


2  For  more  detailed  information,  read  Brief  of  Incident  LAX93IA245  (enclosed). 


5 


recommends,  “Push  the  handle  down  to  its  lowest  position  while  you  push  inboard  on  the  carrier 
to  make  sure  the  carrier  is  locked  in  the  inboard  position.” 

In-Service  Activities  Report  and  Service  Bulletin  History  Regarding  B-757  Off-Wing 
Escape  Slides 

In  its  September  14,  1993,  B-757  In-Service  Activities  Report  (SAR)  No.  93-17,  Boeing 
alerted  operators  of  B-757s  with  off- wing  slides  (part  number  93-17-2565-00)  of  the 
June  8,  1993,  incident.3  The  SAR  stated  that  the  fuselage’s  paint  had  been  scuffed  in  several  large 
areas  aft  of  the  slide  compartment  door  and  on  the  leading  edge  of  the  left  horizontal  stabilizer. 
The  SAR  further  stated  that  the  aft  latch  of  the  airplane’s  left  off-wing  escape  slide  compartment 
door  was  only  partially  engaged,  allowing  the  forward  edge  of  the  compartment  door  to  open  in 
the  air  stream  and  then  to  flex  further  into  the  air  stream  until  it  was  forced  open.  The  SAR 
further  revealed  that  after  the  door  had  opened,  the  escape  slide’s  carrier  freely  rotated  out  of  its 
compartment,  the  slide  release  pin  was  pulled,  and  the  escape  slide  unpacked  and  tore  free  from 
its  packboard.  Finally,  the  SAR  stated  that  the  B-757  maintenance  manual’s  section  25-65-09 
would  be  updated  on  September  20,  1993,  to  incorporate  slide  access  door  placard  instructions 
and  to  clarify  maintenance  procedures  for  closing  and  properly  locking  the  off-wing  slide  door. 

On  October  10,  1996,  Boeing  issued  Service  Bulletin  (SB)  757-25-0182  to  all  operators 
of  B-757  airplanes  with  off-wing  escape  slide  systems  through  airplane  production  line  position 
727  (the  727th  B-757  produced).  The  SB  reported  that  two  additional  incidents  had  occurred 
since  June  1993  in  which  air  carrier  operators  had  experienced  the  separation  in  flight  of  an  off- 
wing  emergency  escape  slide  that  resulted  in  damage  to  the  airplane  fuselage  aft  of  the  slide 
compartment.4  All  three  incidents  had  occurred  following  maintenance.  The  SB  stated  that 
Boeing’s  analysis  of  the  off-wing  slide  separations  found  three  problems  that  induced  the 
separations: 

•  difficulty  in  visually  inspecting  the  forward  edge  of  the  slide  compartment  door  to 
ensure  that  it  is  correctly  latched, 

•  the  aft  location  of  the  door’s  electrical  sensor  may  not  clearly  indicate  whether  the 
forward  edge  of  the  slide  compartment  door  is  latched,  and 

•  the  incorrect  installation  of  the  lockbase  retainer  on  the  door  latch  tube,  which  can 
prevent  locking  the  door  latch  tube  in  the  latched  position. 

To  remedy  these  problems,  the  SB  provided  instructions  to  replace  the  lockbase  retainer 
and  the  bearing  for  the  door’s  latch  tube  and  to  relocate  the  door’s  sensor  forward  on  the  slide 
compartment  door. 


3 

About  50  percent  of  the  B-757  airplanes  manufactured  by  Boeing  are  equipped  with  off-wing  emergency 
escape  slides. 

4  The  two  previous  B-757  off-wing  emergency  escape  slide  incidents  involved  separations  of  right  off-wing 
slides  on  a  Continental  Airlines  B-757  on  September  25,  1995,  and  a  Boeing  flight  test  B-757  airplane  on 
November  15, 1995. 
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Since  Boeing  issued  SB  757-25-0182,  three  other  in-flight  B-757  off-wing  emergency 
escape  slide  separations  have  occurred  following  maintenance  of  the  slides:  the  Delta  Airlines 
N629DL  on  June  2,  1998;  the  United  Airlines  N581UA  on  October  16,  1997;  and  one  involving 
an  American  Airlines  B-757  on  June  24, 1997.  These  airplanes  had  not  been  modified  as  directed 
by  SB  757-25-0182.  American  Airlines  subsequently  painted  a  red  stripe  on  the  B-757  off- wing 
escape  slide  compartment  door  frames  to  help  mechanics  determine  when  the  slide  compartment 
door  is  properly  positioned  and  latched. 

On  November  13,  1997,  subsequent  to  the  United  and  American  separations,  Boeing 
issued  All-Operator  Message  M-7272-97-5654  to  advise  B-757  operators  of  the  importance  of 
incorporating  SB  757-25-0182.  The  message  informed  operators  of  the  importance  of 
incorporating  the  SB  at  their  earliest  opportunity,  of  placing  a  new  decal  on  the  inside  of  the 
access  door,  of  placing  a  paint  stripe  or  tape  on  the  lip  of  the  maintenance  access  door  (to  show 
proper  alignment  and  the  locked  position  of  the  round  yellow  crank  handle),  and  of  removing  the 
access  panel  from  the  container  shroud  in  the  main  gear  wheel  well  while  a  mechanic  visually 
inspects  that  the  carrier  latch  pin  is  fully  engaged  with  the  lock  carrier  fitting.  Boeing  reported 
that  on  May  20,  1998,  the  contents  of  the  All-Operator  Message  were  incorporated  into  its 
maintenance  manuals. 

The  Safety  Board  commends  all  of  the  efforts  made  by  Boeing;  however,  the  Board  is 
concerned  that  because  these  measures  are  not  mandatory  some  operators  may  not  perform  the 
actions  set  forth  in  the  SB.  Therefore,  the  Safety  Board  believes  that  the  Federal  Aviation 
Administration  (FAA)  should  issue  an  airworthiness  directive  (AD)  to  make  compliance  with 
Boeing  SB  757-25-0182  mandatory  to  reduce  the  current  potential  for  in-flight  separation  of  the 
off-wing  escape  slides. 

In  a  June  30,  1998,  letter  to  the  Safety  Board,  Boeing  stated  that  it  was  designing  the 
following  three  new  system  enhancements  for  the  B-757  off-wing  escape  slides: 

1. )  installation  of  a  bumper  on  the  slide  pack  carrier  to  ensure  it  is  pushed  in  far  enough 

to  be  locked  in  place  and  to  prevent  movement  of  the  carrier  before  actuation  of  the 
yellow  crank  handle, 

2. )  the  addition  of  a  witness  mark  on  the  Up  of  the  maintenance  access  door  frame  that 

ahgns  with  the  yellow  crank  handle  to  ensure  the  handle  is  in  the  locked  position,  and 

3. )  the  rewriting  of  the  instructions  on  the  placard  on  the  inside  of  the  maintenance  access 

door  to  provide  clear,  concise  direction  to  ensure  the  door  is  faired  and  latched  prior 
to  flight. 

Boeing  further  reported  that  the  three  system  enhancements  are  currently  in  the  design 
phase  and  will  be  incorporated  into  the  B-757  production  Une  in  December  1998.  Boeing 
proposed  that  the  B-757  fleet  retrofit  will  be  handled  by  a  SB  that  will  incorporate  all  three 
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enhancements.  Therefore,  as  a  further  safety  measure,  the  Safety  Board  believes  that  the  FAA 
should,  upon  release  of  the  SB  that  incorporates  the  B-757  off-wing  escape  slide  system 
enhancements  currently  in  work  by  Boeing,  issue  an  AD  to  mandate  the  incorporation  of  the 
improvements. 

The  Safety  Board  is  concerned  that  mechanics  may  not  be  aware  of  Boeing’s  recently 
completed  and  proposed  system  enhancements  on  the  B-757  off-wing  escape  slides.  Further, 
because  the  B-757  off-wing  escape  slides  are  not  frequently  serviced  or  replaced,  updated  training 
would  acquaint  the  mechanics  with  the  recent  changes  and  improvements  to  the  B-757  off-wing 
escape  slide  system.  Therefore,  the  Safety  Board  believes  the  FAA  should  issue  a  flight  standards 
information  bulletin  to  require  that  principal  maintenance  inspectors  ensure  that  all  mechanics  are 
trained  on  the  new  off-wing  escape  slide  system  enhancements  on  the  B-757. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Issue  an  airworthiness  directive  to  make  compliance  with  Boeing  Service  Bulletin 
757-25-0182  mandatory  to  reduce  the  current  potential  for  in-flight  separation  of 
the  off-wing  escape  slides.  (A-98-122) 

Upon  release  of  the  service  bulletin  that  incorporates  the  B-757  off-wing  escape 
slide  system  enhancements  currently  in  work  by  Boeing,  issue  an  airworthiness 
directive  to  mandate  the  incorporation  of  the  improvements.  (A-98-123) 

Issue  a  flight  standards  information  bulletin  to  require  that  principal  maintenance 
inspectors  ensure  that  all  mechanics  are  trained  on  the  new  off-wing  escape  slide 
system  enhancements  on  the  B-757.  (A-98-124) 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMIDT, 
GOGLIA,  and  BLACK  concurred  in  these  recommendations. 
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hold  the  bottom  comers  of  the  33  inch  wide  slide  door  closed  while  manipulating  the  latching  handle  in  a  maintenance 
access  door  12  inches  aft  of  the  slide  door.  The  procedure  has  since  been  changed  to  require  two  mechanics,  one  to  hold 
the  door  closed  while  the  second  manipulates  the  latching  handle. 


Brief  of  Incident  (Continued) 


V 


00 

W 

•O 

in  in 


8 

•H 

U 

rt 

r*  U 
4) 

Vl  41 
3  W 
o  ns 

&£ 


o 

s 

a 


i  t  i 


•H  H  n  n 
T> 

a 

■H 

tm 


Q4IUE 

i«3. 

H  d  m3 


Format  Revision  4/97 


National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  December  3,  1998 
In  reply  refer  to:  A-98-125  and  -126 


Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  December  6,  1995,  Pakistan  International  Airlines  (PIA)  flight  722,  a  Boeing  747-240 
“Combi”  airplane,1  experienced  an  uncontained  failure2  in  the  low  pressure  turbine  (LPT)  area  of 
the  No.  2  engine,  a  General  Electric  Aircraft  Engines  (GE)  CF6-50E2,  shortly  after  takeoff  from 
John  F.  Kennedy  International  Airport  (JFK),  New  York.3  The  flightcrew  reported  that  as  the 
airplane  was  climbing  through  1,000  feet,  they  heard  a  loud  thud  and  grinding  noise  and  that  the 
airplane  then  yawed  to  the  left.  The  flight  engineer  reported  that  immediately  after  he  heard  the 
thud,  he  noted  that  the  No.  2  engine  oil  pressure  and  oil  quantity  gauges  were  both  indicating 
zero.  The  flightcrew  continued  the  climb  and  later  shut  down  the  No.  2  engine.  The  airplane 
returned  to  JFK  and  landed  without  further  incident.  None  of  the  240  passengers  and  15 
crewmembers  on  board  were  injured.  The  airplane  was  operating  on  an  instrument  flight  rules 
(IFR)  flight  plan  under  the  provisions  of  Title  14  Code  of  Federal  Regulations  (CFR)  Part  129  as 
a  regularly  scheduled  international  passenger  and  cargo  flight  from  JFK  to  Charles  de  Gaulle 
Airport,  Paris,  France. 

The  examination  of  the  No.  2  engine  revealed  that  most  of  the  LPT  module  was  missing 
(see  figure  1).  The  airplane  had  punctures  to  its  left  wing  leading  edge  slats  and  to  a  landing  gear 
door.  In  addition,  the  No.  1  engine  had  hard  body  impact  damage4  to  18  of  the  38  fan  blades,  and 
the  fan  cowl  had  impact  damage  from  the  debris  ejected  from  the  No.  2  engine. 


A  Boeing  747  Combi  airplane  is  configured  such  that  it  can  cany  both  passengers  and  cargo  on  the  main  deck. 

2  An  uncontained  engine  failure  occurs  when  an  internal  part  of  the  engine  fails  and  is  ejected,  or  results  in  other 
parts  being  ejected,  through  the  cowling. 

3  For  more  detailed  information,  see  Brief  of  Incident  NYC96IA036  (enclosed). 

Hard  body  impact  damage  is  characterized  by  a  serrated  appearance  and  deep  cuts  to  the  airfoil’s  leading  and 
trailing  edges.  Hard  body  impact  damage  can  result  from  impact  with  metal  parts,  concrete,  asphalt,  and  rocks. 
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Figure  1.  Cross  section  of  CF6-50  engine  and  expanded  view  of  LPT  module 

Disassembly  of  the  engine,  serial  number  (SN)  455-954,  at  GE’s  Engine  Maintenance 
Center,  Ontario,  California,  under  the  direction  of  the  National  Transportation  Safety  Board, 
revealed  that  the  fan  midshaft  (FMS)  was  fractured  circumferentially,  just  aft  of  the  No.  3  (roller) 
bearing.  Although  the  No.  3  bearing  was  damaged,  the  damage  was  typical  of  secondary  damage 
that  would  have  occurred  late  in  the  engine  failure  sequence. 

Examination  of  the  fractured  FMS  by  the  Safety  Board’s  and  GE’s  materials  laboratories 
revealed  a  fatigue  fracture  with  multiple  origins  on  the  outer  diameter  (OD)  of  the  shaft  that 
propagated  inward.  The  examinations  also  revealed  a  color  variation  across  the  fracture  surface 
and  a  reduction  of  the  material  hardness  at  the  fracture  in  comparison  to  the  other  areas  of  the 
FMS  and  the  engineering  drawing  specification,  indicating  that  the  part  had  been  previously 
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overheated.  In  addition,  SerMetel  paint5  was  found  on  the  surface  of  the  fatigue  fracture, 
suggesting  that  the  crack  existed  but  was  not  detected  when  the  shaft  had  been  painted  following 
a  previous  repair. 

The  maintenance  records  for  the  fractured  FMS,  part  number  9032M21P18, 
SN  MPOE3573,  show  that  it  had  been  installed  in  another  PIA  CF6-50  engine,  SN  455-927’ 
which  was  brought  into  PIA’s  engine  shop  on  September  26,  1986,  because  of  a  No.  3  bearing 
failure.  The  records  show  that  the  FMS  was  overhauled,  magnetic  particle  inspected  (MPI),6 
hardness  checked  in  Area  B,7  dimensionally  inspected,  and  painted.  At  the  time  of  the  No.  3 
bearing  failure  in  PIA  engine  SN  455-927,  the  FMS  had  4,594  cycles  since  new  (CSN).  The 
fracture  occurred  9,235  cycles  later  at  13,829  CSN.  The  records  also  show  that  PIA  overhauled, 
conducted  an  MPI,  and  painted  the  FMS  on  August  12,  1991,  at  9,764  CSN,  4,065  cycles  before 
the  fracture;  and  on  December  14,  1993,  at  12,292  CSN,  1,537  cycles  before  the  fracture.  There 
was  no  record  that  the  FMS  had  been  inspected  by  etching  the  surface,8  as  required  by  the  CF6- 
50  Shop  Manual9  if  the  shaft  had  been  rubbed.10 

The  Safety  Board  is  concerned  about  the  potential  for  other  FMS  fractures  from  rubs 
sufficient  to  overheat  the  material  and  reduce  its  tensile  and  fatigue  properties  but  not  sufficient  to 
cause  damage  warranting  an  inspection  of  the  shafts.  However,  the  Safety  Board  notes  that  as  a 
result  of  the  PIA  investigation,  GE  issued  Alert  Service  Bulletin  CF6-50  72-A1120  on  April  4 
1997,  which  identifies  other  CF6-50  FMSs  that  had  been  rubbed  and  provides  a  one-time  eddy 
current  inspection  procedure  to  identify  and  remove  from  service  any  FMSs  that  were  overheated. 


The  disassembly  of  the  PIA  engine  showed  that  the  center  section  of  the  FMS  had  become 
wedged  into  the  high  pressure  compressor  (HPC)  bumper  bearings.  The  design  of  the  CF6-50 
engine’s  FMS  is  such  that  the  OD  of  the  forward  half  of  the  shaft  is  greater  than  the  inner 
diameter  of  the  bumper  bearing  on  the  inside  of  the  HPC  rear  hub.  On  the  PIA  engine,  when  the 
FMS  fractured  at  its  forward  end,  the  rear  section  moved  aft,  and  the  larger  diameter  section  of 
the  shaft  became  wedged  into  the  bumper  bearing,  limiting  the  rearward  movement  of  the  LPT 


5  SeiMetel  paint  is  an  aluminum-based  corrosion  preventative  coating 
MPI  is  a  nondestructive  method  of  detecting  cracks  and  other  defects  in  ferromagnetic  materials  such  as  iron  or 

steel.  The  inspection  consists  of  magnetizing  the  part  with  high-amperage,  direct  current  electricity,  thus  creating 
magnetic  lines  of  flux,  then  applying  or  immersing  the  part  in  a  liquid  containing  ferromagnetic  particles  in 
suspensioa  The  ferromagnetic  particles  align  themselves  with  the  magnetic  lines  of  flux  on  the  surface  of  the  part 
forming  a  pattern.  If  a  discontinuity  is  present  in  the  material  on  or  near  the  surface,  opposing  magnetic  poles 
form  on  either  side  of  the  discontinuity  and  the  pattern  is  disrupted,  forming  an  “indication.”  The  indications 
assume  die  approximate  size  and  shape  of  the  surface  projection  of  the  discontinuity;  however,  indications  are 
more  visible  when  the  defects  are  approximately  perpendicular  to  the  magnetic  lines  of  flux. 

Area  B  is  on  the  forward  section  of  the  FMS,  away  from  the  area  of  the  fracture. 

Etching  the  surface  is  a  nondestructive  test  procedure  that  will  show  if  the  base  metal  has  been  locally  overheated 
because  of  a  mb. 

9  GE  CF6-50  Task  Numbered  Shop  Manual,  Inspection,  Subtask  72-24-01-220-053. 

10  The  No.  3  bearing  supports  and  aligns  the  forward  end  of  the  FMS.  When  the  bearing  fails,  the  FMS  shifts 
slightly,  allowing  contact  with  the  HPC  disk  bore  causing  robbing  and  frictional  overheating.  In  the  PIA  event,  the 
rub  on  the  FMS  would  have  been  evident  when  it  was  repaired  in  1986  after  the  No.  3  bearing  failure.  Since  the 

FMS  was  painted  in  1986,  after  the  No.  3  bearing  failure,  the  rob  damage  would  not  have  been  evident  during 
subsequent  inspections. 
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rotor.  With  the  FMS  wedged  into  the  bumper  bearing,  the  LPT  rotor  was  then  driven  by  the  high 
pressure  rotor,  which  has  a  rotational  speed  more  than  twice  the  rpm  limit  of  the  low  pressure 
rotor.  Additionally,  two  stage  4  LPT  blade  roots  recovered  from  the  core  cowl  had 
circumferential  grooves  on  their  rear  faces.  The  grooves  corresponded  to  the  forward  edge  of  the 
turbine  rear  frame  (TRF)  inner  duct,  indicating  that  additional  structure  had  limited  the  rearward 
movement  of  the  LPT  rotor  and  meshing11  action,  thus  permitting  the  rotor  to  overspeed.  Several 
stage  1  LPT  blades  recovered  from  the  wing  slat  area  were  rubbed  on  the  rear  faces  of  their  roots 
and  had  the  rear  portions  of  the  blade  root  serrations  sheared  consistent  with  the  radial  outward 
movement  of  the  blades,  suggesting  that  those  blades  were  pushed  out  of  the  disk  from  the  rear 
and  separated  under  high-centrifugal  loads. 

On  February  22,  1996,  a  Continental  Airlines  McDonnell  Douglas  DC-10  airplane 
sustained  uncontained  LPT  damage  to  the  No.  3  engine,  a  CF6-50C2,  because  of  an  FMS  fracture 
during  the  takeoff  roll  at  Houston,  Texas.  The  flightcrew  reported  that  when  they  heard  the 
engine  surge,12  they  immediately  retarded  the  power  levers  to  idle  and  rejected  the  takeoff.  The 
engine’s  core  cowl  was  penetrated  by  turbine  blade  fragments,  but  no  damage  to  any  other  part  of 
the  airplane  occurred.  The  examination  of  the  Continental  Airlines  engine  showed  that  the  FMS 
had  fractured  near  the  forward  end  after  being  rubbed  by  the  HPC  air  duct,  which  had  fractured 
circumferentially  along  the  seam  of  a  previous  weld  repair  because  of  porosity  in  the  weld.  The 
examination  also  revealed  that  the  FMS  had  become  wedged  into  the  HPC  bumper  bearing,  and 
the  stage  4  LPT  blades  were  rubbed  on  their  rear  faces,  much  like  on  the  PIA  engine. 

GE  reported  that  a  dimensional  inspection  of  the  LPT  disks  showed  that  the  disks  had 
“grown,”  indicating  that  the  LPT  rotor  had  accelerated  to  140  percent  rpm.13  The  Safety  Board  is 
concerned  about  the  LPT  rotor  overspeeds  and  uncontained  LPT  damage  that  occur  even  when 
the  flightcrew  promptly  retards  the  engine  power,  as  was  done  by  the  Continental  Airlines 
flightcrew.  The  Safety  Board  is  further  concerned  about  the  extent  of  resultant  damage  when  an 
FMS  fracture  occurs  and  the  flightcrew  cannot  immediately  reduce  power  on  the  affected  engine, 
such  as  on  the  PIA  flight.  The  rubs  on  the  rear  faces  of  the  stage  4  LPT  blade  roots  and  the 
wedging  of  the  FMS  into  the  HPC  bumper  bearing,  which  were  noted  on  the  PIA  and  Continental 
Airlines  engines,  indicate  that  the  meshing  action  of  the  CF6-50  engine’s  LPT  rotor  is  being 
impeded.  The  turbine  disk  growth  that  was  noted  on  the  Continental  Airlines  engine  shows  that 
the  limited  meshing  action  allowed  the  overspeed  of  the  LPT.  Therefore,  the  Safety  Board 
believes  that  the  Federal  Aviation  Administration  (FAA)  should  require  GE  to  modify  the  CF6-50 
engine  to  eliminate  the  impediments  to  the  aft  translation  of  the  LPT  rotor  that  limits  the  amount 
of  meshing  that  occurs  in  the  event  of  an  FMS  fracture. 


11  Meshing  is  the  desired  clashing  of  the  turbine  blades  and  vanes  following  a  turbine  rotor  shaft  fracture  that  is 
intended  to  decelerate  the  rotor  and  to  break  the  blades  into  small  particles,  thus  reducing  the  likelihood  of  blades 
penetrating  an  engine  casing. 

12  A  surge  is  a  disruption  of  the  airflow  through  the  compressors  resulting  in  a  stagnation  or  reversal  of  the  airflow 
and  is  typified  by  loud  reports  or  bangs  and  flames  from  the  inlet  and  tailpipe. 

13  When  a  disk  exceeds  its  rotational  speed  limit,  the  extreme  centrifugal  loads  cause  plastic  deformation  of  the 
part  so  that  the  diametrical  dimensions  of  the  disk  are  greater  following  the  overspeed  event. 
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Because  of  other  incidents,  the  Safety  Board  is  also  concerned  about  the  LPT  containment 
capability  of  GE’s  CF6-80  series  engines.  On  January  24,  1996,  American  Airlines  flight  1745,  an 
Airbus  Industrie  A300-600  airplane,  experienced  an  uncontained  LPT  failure  in  the  No.  1  engine, 
a  GE  CF6-80C2A5,  just  after  takeoff  from  Philadelphia,  Pennsylvania.  It  was  operating  on  an  IFR 
flight  plan  under  the  provisions  of  14  CFR  Part  121  as  a  regularly  scheduled  passenger  flight  from 
Philadelphia  to  San  Juan,  Puerto  Rico.  The  flightcrew  reported  that  as  the  airplane  was  climbing 
through  1,000  feet,  they  heard  a  “soft  thunk”  and  the  No.  1  engine  spooled  down  to  idle.  The 
airplane  returned  and  landed  at  Philadelphia  without  further  incident,  and  none  of  the  passengers 
and  crewmembers  were  injured.  The  flightcrew  reported  that  the  No.  1  engine  ran  at  idle  power 
*  until  the  crew  shut  it  down  after  the  airplane  had  landed. 

Examination  of  the  No.  1  engine  revealed  that  the  core  cowl  had  a  15-inch  long 
(circumferential)  by  6-inch  wide  (axial)  hole  in  the  plane  of  the  stage  4  LPT  rotor.  There  were 
numerous  dents  and  impact  marks  on  the  underside  of  the  left  wing’s  inboard  aileron  and  the 
outboard  side  of  the  inboard  flap  track  fairing,  both  of  which  are  directly  aft  of  the  No.  1  engine’s 
exhaust.14 

The  engine  was  disassembled  and  examined  under  the  direction  of  the  Safety  Board  at 
Motoren-und  Turbinen-Union  (MTU),  Hannover,  Germany.15  The  disassembly  revealed  that  the 
tip  of  one  interturbine  temperature  (T49)16  probe  had  broken  off  and  impacted  one  stage  1  LPT 
blade,  causing  a  fatigue  fracture  of  the  airfoil  near  the  blade  tip  shroud  (see  figure  2).  All  of  the 
stage  2,  3,  4,  and  5  LPT  blades  were  found  in  their  respective  disks;  however,  all  were  fractured 
transversely  across  the  airfoils  at  various  lengths  above  the  blade  root  platforms.  The  disassembly 
also  revealed  that  the  LPT  case  had  a  17-inch  by  2-inch  wide  hole  in  the  stage  4  LPT  plane  of 
rotation.  The  damage  to  the  LPT  rotor  was  progressively  worse  along  the  gaspath,  suggesting 
that  the  stage  1  LPT  blade  tip  separated  first,  that  all  of  the  blades  in  the  following  stages  were 
then  fractured,  and  that  the  mass  of  material  became  larger  as  it  progressed  through  the  rotor, 
subsequently  resulting  in  a  case  rupture  in  the  stage  4  area. 


14  There  was  no  indication  that  any  of  the  material  that  exited  through  the  core  cowl  struck  the  wing  or  fuselage. 

15  American  Airlines  had  the  maintenance  and  repair  of  its  GE  CF6-80C2  engines  contracted  out  to  MTU  at  that 
time. 

'6  Gas  turbine  engine  convention  is  to  number  the  aerodynamic  engine  stations  with  station  1  being  at  the  engine 
inlet  and  to  use  progressively  higher  numbers  along  the  gas  path  to  the  exhaust  nozzle.  Generally,  the  number  is 
accompanied  by  a  prefix  P  (pressure)  or  T  (temperature).  In  the  CF6-80  series  engine,  station  4.9  would  indicate 
that  the  probe  was  located  between  the  high  and  low  pressure  turbine  rotors. 
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Figure  2.  Cross  section  of  CF6-80C2  engine  and  expanded  view  of  LPT  module 

The  Safety  Board  is  aware  of  a  similar  event  that  occurred  on  September  5,  1997,  when  a 
Federal  Express  (FedEx)  McDonnell  Douglas  MD-11  airplane,  equipped  with  GE  CF6-80C2 
engines,  had  an  uncontained  LPT  failure  in  the  plane  of  the  stage  4  LPT  rotor.  The  disassembly 
of  the  FedEx  engine  showed  that  a  stage  1  LPT  airseal  segment  had  broken  loose  from  the  LPT 
case  and  passed  through  the  gaspath  causing  the  breakage  of  the  downstream  turbine  blades.  As 
in  the  American  Airlines  LPT,  the  damage  in  the  FedEx  LPT  rotor  was  more  extensive 
downstream  along  the  gaspath.  The  evidence  shows  that  both  the  American  Airlines  and  FedEx 
LPT  cases  withstood  the  initial  containment  challenge  of  the  separation  of  an  LPT  blade; 
however,  neither  case  could  withstand  the  loads  imparted  by  the  resultant  mass  of  broken  LPT 
airfoils.  This  suggests  that  the  design  containment  capability  of  the  LPT  case  is  inadequate. 

To  gain  a  clearer  understanding  of  the  number  and  frequency  of  uncontained  LPT  failures 
in  CF6  engines,  the  Safety  Board  requested,  and  GE  provided,  a  list  of  all  such  failures  that  have 
occurred  in  the  CF6-50  and  -80  series  commercial  engine  fleet.  The  GE  data  show  that  the 
CF6-50  engine  had  experienced  25  uncontained  LPT  failures  as  of  1997,  including  the  PIA  and 
Continental  Airlines  FMS  fracture  events,  and  that  the  CF6-80C2  engine  had  experienced  6 
uncontained  LPT  failures  as  of  1997,  including  the  American  Airlines  and  FedEx  events.  GE 
attributed  these  uncontained  LPT  failures  to  LPT  blade  fractures,  FMS  fractures,  and  other 
causes. 


Turbine  engine  rotor  cases  are  required  to  ensure  containment  of  fractured  blades  by 
14  CFR  33.19,  which  states  in  part  that  “the  design  of  the  compressor  and  turbine  rotor  cases 
must  provide  for  the  containment  of  damage  from  rotor  blade  failure.”  The  requirements  for 
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turbine  containment  are  further  addressed  in  14  CFR  33.75,  which  notes  in  part  that  “any 
probable  single  or  multiple  failure... will  not  cause  an  engine  to... burst  (release  hazardous 
fragments  through  the  engine  case).”  Because  the  uncontained  LPT  failures  in  the  CF6-50  and 
-80C2  engines  were  attributed  to  a  number  of  different  causes,  the  LPT  containment  capability  of 
these  engines  must  be  improved  to  comply  with  14  CFR  33.19  and  33.75. 

The  Safety  Board  notes  that  as  a  result  of  uncontained  LPT  failures  that  were  initiated  by 
blade  or  shaft  fractures  in  the  Pratt  &  Whitney  (P&W)  JT8D-1  through  -17AR  and  JT9D  engines, 
the  FAA  required  modification  of  those  engines  to  improve  the  LPT  containment  through 
Airworthiness  Directives  97-19-14  and  96-25-10,  respectively.17  The  same  standard  should  apply 
to  GE  CF6  engines.  Therefore,  the  Safety  Board  believes  that  the  FAA  should  require  GE  to 
improve  the  ability  of  the  CF6-50  and  the  CF6-80  series  engines  to  prevent  fractured  LPT  blades 
from  being  liberated  through  the  engine  cowling. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Require  General  Electric  Aircraft  Engines  to  modify  the  CF6-50  engine  to 
eliminate  the  impediments  to  the  aft  translation  of  the  low  pressure  turbine  rotor 
that  limits  the  amount  of  meshing  that  occurs  in  the  event  of  a  fan  midshaft 
fracture.  (A-98-125) 

Require  General  Electric  Aircraft  Engines  to  improve  the  ability  of  the  CF6-50  and 
the  CF6-80  series  engines  to  prevent  fractured  low  pressure  turbine  blades  from 
being  liberated  through  the  engine  cowling.  (A-98-126) 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMIDT, 
GOGLIA,  and  BLACK  concurred  in  these  recommendations. 


Enclosure 


17  The  CF6-50  series  engine,  which  was  first  certificated  in  1972  and  has  about  2,008  engines  in  service, 
experienced  25  uncontained  LPT  failures.  The  CF6-80  series  engine,  which  was  first  certificated  in  1981  and  has 
about  2,977  engines  in  revenue  service,  experienced  6  uncontained  LPT  failures.  In  comparison,  the  JT8D-1 
through  -17AR  engine  series,  which  was  first  certificated  in  1961  and  has  about  9,975  engines  in  service, 
experienced  about  55  uncontained  LPT  failures.  The  JT9D  engine,  which  was  first  certificated  in  1968  and  has 
about  566  engines  in  service,  experienced  64  uncontained  LPT  failures.  All  of  the  uncontained  LPT  failures  in  the 
GE  CF6-50  and  -80  series  engines  and  in  the  P&W  JT8D  and  JT9D  engines  were  blade  penetrations  caused  by 
fractures  of  the  LPT  blades  or  the  fracture  of  the  LPT  turbine  drive  shaft. 
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National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 

Date:  December  18,  1998 
In  reply  refer  to:  A-98-127  through  -128 


Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  April  18,  1997,  at  1824  Pacific  daylight  time,  America  West  flight  66  (AWE66),  a 
Boeing  737,  and  Ameriflight  1898  (AMF1898),  a  Beech  99,  were  involved  in  a  near-midair 
collision  approximately  25  miles  south  of  McCarran  International  Airport,  Las  Vegas,  Nevada. 
A  flight  attendant  in  the  cabin  fell  and  was  seriously  injured  as  AWE66  maneuvered  to  avoid  the 
Ameriflight  aircraft.  Both  flights  were  operating  in  visual  meteorological  conditions  at  the  time 
of  the  accident.1 

AMF1898  had  departed  Las  Vegas,  en  route  to  Burbank,  California,  as  a  nonscheduled, 
domestic  cargo  flight  under  14  Code  of  Federal  Regulations  (CFR)  Part  135.  AWE66  had 
departed  from  John  Wayne  -  Orange  County  Airport  as  a  scheduled  passenger  flight  operating 
under  14  CFR  Part  121.  The  pilot  of  AMF1898  had  elected  to  depart  Las  Vegas  on  a  visual 
flight  rules  (VFR)  flight  plan  and  to  fly  at  10,500  feet.  A  review  of  the  recorded  voice 
communications  between  the  radar  controller  at  the  Las  Vegas  terminal  radar  approach  control 
(TRACON)  and  the  crews  of  each  airplane  indicated  that  the  controller  terminated  radar  services 
with  AMF1898  at  the  lateral  limit  of  the  Las  Vegas  class  B2  airspace.  AWE66  contacted  the  Las 
Vegas  radar  controller  about  40  seconds  later,  about  45  miles  southwest  of  Boulder  City  at 
12,000  feet.  The  flight  was  directed  to  descend  to  an  altitude  of  10,000  feet  on  heading  020. 
One  minute  later,  the  controller  issued  traffic  to  the  crew  of  AWE66,  “twelve  o’clock  three  miles 


1  In  accordance  with  49  CFR  Part  830.2,  the  Safety  Board  classified  this  event  as  an  aircraft  accident  because  of  the 
serious  injury  to  the  flight  attendant. 

2  Class  B  airspace  is  generally  defined  as  that  airspace  from  the  surface  to  10,000  feet  mean  sea  level  surrounding  the 
nation's  busiest  airports  in  terms  of  airport  operations  or  passenger  enplanements.  The  configuration  of  each  Class  B 
airspace  area  is  individually  tailored  and  consists  of  a  surface  area  and  two  or  more  layers  (some  Class  B  airspace 
areas  resemble  upside  down  wedding  cakes).  An  air  traffic  control  (ATC)  clearance  is  required  for  all  aircraft  to 
operate  in  class  B  airspace,  and  all  aircraft  that  are  so  cleared  receive  separation  services  within  the  airspace. 
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opposite  direction,  altitude  indicates  nine  thousand  three  hundred,”  and  then  instructed  the  crew 
to  “climb  as  you  wish.”  Twenty  seconds  later,  the  controller  advised  AWE66  that  the  traffic  was 
no  longer  a  factor.  The  pilot  replied,  “That  was  close.” 

On  initial  contact  with  Las  Vegas  TRACON,  the  controller  issued  AWE66  a  descent 
clearance  and  vector  that  placed  it  in  direct  conflict  with  AMF1898.  The  controller  then  issued  a 
traffic  advisory  to  AWE66  and  authorized  a  climb,  if  necessary,  to  comply  with  an  anticipated 
traffic  alert  and  collision  avoidance  system  (TCAS)  resolution  advisory  (RA),3  recognizing  that 
at  least  one  of  the  two  aircraft  would  need  to  maneuver  to  avoid  the  other.  AMF1898  had  been 
receiving  radar  advisories  from  the  Las  Vegas  TRACON  until  less  than  2  minutes  before  the 
accident.  ATC  services  were  terminated  at  the  class  B  airspace  boundary  despite  an  earlier  pilot 
request  to  continue  VFR  radar  traffic  advisory  services  for  the  duration  of  the  flight. 

After  a  departing  VFR  aircraft  leaves  charted  class  B  airspace,  controllers  are  no  longer 
required  to  provide  radar  advisory  service.  Although  fully  within  the  scope  of  her  authority 
under  current  rules,  the  controller’s  decision  to  terminate  service  to  AMF1898  immediately  after 
the  aircraft  exited  class  B  airspace  eliminated  the  possibility  of  providing  either  a  traffic  advisory 
to  the  pilot  or  a  suggestion  that  AMF1898  remain  at  or  below  9,500  feet  until  passing  AWE66. 
Instead,  AWE66  received  a  late  advisory,  AMFI898  received  no  ATC  assistance  at  all,  and  an 
accident  occurred. 

This  accident  points  out  an  anomaly  in  the  level  of  service  provided  to  VFR  aircraft 
operating  in  terminal  areas.  Air  traffic  controllers  are  required  to  provide  advisories  to  aircraft 
departing  airports  located  within  class  B  airspace  areas  only  until  the  aircraft  exits  class  B 
airspace,  which  could  in  some  cases  result  in  termination  of  radar  service  as  soon  as  5  to  7  miles 
after  departure.  The  same  aircraft  departing  an  airport  located  in  class  C4  airspace,  normally  of 
lower  traffic  density  and  complexity  than  class  B,  would  be  entitled  to  radar  advisory  service 
until  at  least  20  miles  after  departure  because  controllers  are  prohibited  from  terminating  radar 
service  within  the  class  C  outer  area  without  pilot  request.  It  seems  reasonable  that  aircraft 
operating  near  class  B  airspace,  by  definition  the  most  complex  terminal  airspace  in  the  United 
States,  should  receive  at  least  the  same  level  of  service  as  aircraft  operating  near  less  complex 
class  C  airports.  Extending  the  availability  of  mandatory  advisory  services  to  cover  the  most 
likely  areas  for  encounters  between  VFR  aircraft  and  those  operating  under  IFR  would  improve 


*  RAs  are  visual  and  aural  warnings  from  TCAS  that  alert  pilots  to  a  nearby  aircraft  presenting  a  collision  threat. 
RAs  direct  pilots  to  pitch  the  airplane  nose-up  or  nose-down,  as  required,  to  resolve  the  collision  threat. 

4  Class  C  airspace  is  generally  defined  as  that  airspace  from  the  surface  to  4,000  feet  above  the  airport  elevation 
surrounding  those  airports  that  have  an  operational  control  tower,  are  serviced  by  a  radar  approach  control,  and  have 
a  certain  number  of  instrument  flight  rules  (IFR)  operations  or  passenger  enplanements.  Although  the  configuration 
of  each  class  C  area  is  individually  tailored,  the  airspace  usually  consists  of  a  charted  area  of  5  nautical  mile  radius 
extending  from  the  surface  to  4,000  feet  above  airport  elevation,  a  charted  outer  circle  from  5  to  10  nautical  miles 
radius  extending  from  1,200  feet  to  4,000  feet  above  airport  elevation,  and  an  uncharted  outer  area  generally 
including  the  remainder  of  the  airport  approach  control’s  airspace  to  a  minimum  radius  of  20  miles  from  the  airport. 
Each  person  must  establish  and  maintain  two-way  radio  communications  with  the  ATC  facility  providing  air  traffic 
services  prior  to  entering  the  charted  class  C  airspace.  Class  C  services  include  separation  of  VFR  aircraft  from  IFR 
aircraft. 
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safety  by  reducing  the  chance  of  conflicts,  such  as  the  one  that  precipitated  this  accident.  The 
Safety  Board  believes  that  the  Federal  Aviation  Administration  (FAA)  should  revise  Handbook 
7110.65,  “Air  Traffic  Control,”  to  require  that  controllers  provide  pilots  of  aircraft  departing 
class  B  terminal  areas  under  VFR  the  option  of  continuing  to  receive  radar  advisory  services  until 
leaving  airspace  delegated  to  the  applicable  terminal  radar  approach  control  facility. 

The  design  of  the  CRESO  3  standard  terminal  arrival5  (STAR)  into  Las  Vegas  appears  to 
have  contributed  to  this  near-midair  collision.  Because  of  the  surrounding  high  terrain, 
southbound  VFR  flights  departing  Las  Vegas  are  concentrated  in  the  location  of  this  accident. 
The  CRESO  3  STAR  routing  directs  air  carrier  traffic  into  the  same  area,  descending  in  a 
direction  opposite  to  the  departing  VFR  flights.  Arrival  procedures,  such  as  the  CRESO  3,  are 
developed  in  accordance  with  FAA  Order  7100.9B,  “Standard  Terminal  Arrival  (STAR).”  This 
order  does  not  address  known  concentrations  of  VFR  traffic  as  a  consideration  in  the  selection  of 
STAR  routes,  except  possibly  through  the  interpretation  of  a  general  direction  that  STARs  be 
“compatible  with  local  traffic  flow  management  requirements.”  However,  in  light  of  the  known 
limitations  of  visual  traffic  separation,  the  placement  of  VFR  and  DPR  traffic  flows  in  close 
proximity  should  be  minimized  in  high  density  areas  where  conflicts  are  likely. 

As  the  result  of  an  inquiry  from  the  Safety  Board  regarding  this  accident,  on  October  15, 
1997,  the  manager  of  the  Las  Vegas  TRACON  stated: 

In  response  to  the  request  for  information  regarding  planned  airspace  changes  that 
would  alleviate  the  possibility  of  another  incident  involving  a  VFR  aircraft 
climbing  in  the  path  of  an  IFR  aircraft  on  the  CRESO  arrival,  such  as  the  aircraft 
accident  involving  AWE66,  the  changes  involved  encompass  a  long-term  project, 
require  much  more  planning  and  development,  and  have  yet  to  be  instituted. 

As  of  July  1998,  the  CRESO  arrival  remains  unchanged.  The  Safety  Board  would 
welcome  further  information  on  the  FAA’s  progress  on  the  modification  of  airspace  and 
procedures  in  the  Las  Vegas  area.  The  Safety  Board  believes  that  the  FAA  should  revise  Order 
7100.9,  “Standard  Terminal  Arrival  (STAR),”  to  provide  a  specific  instruction  to  STAR 
designers  to  segregate  concentrated  IFR  traffic  from  concentrated  VFR  traffic  unless  no 
reasonable  alternative  is  available.  Further,  existing  procedures,  including  the  CRESO  3  STAR, 
should  be  reviewed  to  ensure  compliance  with  this  requirement  and  revised  if  necessary. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Revise  Handbook  7110.65,  “Air  Traffic  Control,”  to  require  that  controllers 
provide  pilots  of  aircraft  departing  class  B  terminal  areas  under  visual  flight  rules 
the  option  of  continuing  to  receive  radar  advisory  services  until  leaving  airspace 
delegated  to  the  applicable  terminal  radar  approach  control  facility.  (A-98-127) 


5  A  planned  air  traffic  control  IFR  arrival  procedure  published  for  pilot  use  in  graphic  and/or  textual  form.  STARs 
provide  transition  from  the  en  route  structure  to  an  outer  fix  or  an  instrument  approach  fix/arriva!  waypoint  in  the 
terminal  area. 


Revise  Order  7100.9,  “Standard  Terminal  Arrival  (STAR),”  to  provide  a  specific 
instruction  to  STAR  designers  to  segregate  concentrated  instrument  flight  rules 
traffic  from  concentrated  visual  flight  rules  traffic  unless  no  reasonable  alternative 
is  available.  Further,  existing  procedures  should  be  reviewed  to  ensure  compliance 
with  this  requirement  and  revised  if  necessary.  (A-98-128) 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMIDT, 
GOGLIA,  and  BLACK  concurred  in  these  recommendations. 


National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  January  14, 1999* 

In  reply  refer  to:  A-99-1  and  -2 


Honorable  Jane  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  September  6,  1997,  at  6:35  p.m.  local  time,  a  North  American  T-6-SNJ5,  N1047C, 
experienced  a  loss  of  control  in  flight  while  maneuvering  near  Woodward  Field,  Camden,  South 
Carolina.1  The  airplane  was  operated  by  the  Western  North  Carolina  Air  Museum  under  the 
provisions  of  Title  14  Code  of  Federal  Regulations  Part  91  and  visual  flight  rules.  Visual 
meteorological  conditions  prevailed  at  the  time  of  the  accident.  The  personal  flight  had  originated 
at  6:20  p.m.  from  Woodward  Field;  the  commercial  pilot  had  not  filed  a  flight  plan.  The  pilot  and 
his  passenger  were  fatally  injured,  and  the  airplane  was  destroyed. 

A  friend  of  the  pilot  stated  that  the  pilot  was  on  the  last  flight  of  the  day  after  giving  rides 
in  the  airplane  all  day  at  an  airshow.  The  pilot  was  taking  the  passenger  for  a  ride  to  thank  the 
passenger  for  his  help  throughout  the  day.  According  to  the  pilot’s  friend,  the  fuel  tank  had  been 
refilled  before  a  previous  flight,  and  he  estimated  that  the  airplane  had  between  80  and  85  gallons 
of  fuel  on  board. 

Two  witnesses  in  the  area  observed  a  low-flying  airplane  that  was  doing  aerobatics,  that  is, 
steep  turns,  about  60°  to  70°  of  bank.  They  heard  the  airplane  engine  “begin  missing.”  The 
engine  quit  10  seconds  later.  During  this  10  seconds,  the  pilot  remained  in  a  left  bank.  According 
to  the  witnesses,  after  the  airspeed  deteriorated,  the  aircraft  entered  a  right-hand  spin. 


*  This  is  a  revised  version  of  the  recommendation  letter  issued  on  January  14,  1999.  The 
original  letter  has  been  revised  to  correct  errors  in  references  to  accidents  involving  aerobatics. 


1  NTSB  accident  No.  ATL97FA134. 
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According  to  Advisory  Circular  (AC)  91-48,  “Acrobatics — Precision  Flying  With  a 
Purpose,”  the  Federal  Aviation  Administration  (FAA)  currently  does  not  “require  the  performance 
of  ‘pure’  acrobatics  maneuvers  during  the  flight  test  other  than  the  spin  requirement  for  airplane 
flight  instructor  applicants.  Therefore,  the  FAA  has  not  been  involved  in  establishing  criteria  for 

the  performance  of  acrobatic  maneuvers - ”  Federal  Aviation  Regulation  (FAR)  91.303  defines 

acrobatic  flight  as  “an  intentional  maneuver  involving  an  abrupt  change  in  an  aircraft’s  attitude,  an 
abnormal  attitude,  or  abnormal  acceleration,  not  necessary  for  normal  flight.”  In  AC  91-48,  under 
discussion  of  the  definition  of  acrobatic  flight,  the  FAA  notes  the  requirement  that  occupants  wear 
parachutes  for  maneuvers  exceeding  a  bank  of  60°  relative  to  the  horizon  or  a  nose-up  or  nose- 
down  attitude  of  30°  relative  to  the  horizon. 

Regarding  the  medical  condition  of  the  pilot-in-command  of  the  aircraft  that  crashed  near 
Woodward  Field,  the  pilot’s  medical  records  indicated  severe  coronary  artery  disease  for  which  he 
was  receiving  medical  treatment  with  diltiazem.  The  autopsy  report  noted  the  same  disease,  and 
scarring  of  his  heart  noted  on  the  autopsy  report  further  indicated  that  he  had  probably  had  a 
myocardial  infarction  (heart  attack)  at  some  time  long  before  his  accident.  The  FAA  was  aware  of 
the  pilot’s  condition,  required  that  he  receive  special  evaluation  for  it,  and  granted  him  an 
Authorization  for  Special  Issuance  of  a  third  class  medical  certificate,  but  the  FAA  did  not  restrict 
his  certificate  in  any  way  (other  than  a  requirement  for  near  vision  correction). 

The  FAA’s  Civil  Aeromedical  Institute  (CAMI)  in  Oklahoma  City,  Oklahoma,  completed  a 
toxicological  examination  of  specimens  from  the  pilot  on  December  18,  1997.  According  to  the 
report,  the  pilot  tested  positive  for  fluoxetine,  norfluoxetine,  cimetidine,  and  diltiazem.  According 
to  the  1998  Physicians  Desk  Reference,  fluoxetine  is  a  prescription  antidepressant  that  can  induce 
anxiety,  drowsiness,  nervousness,  insomnia,  and  dizziness.  The  FAA  does  not  permit  an  aviation 
medical  examiner  to  issue  a  medical  certificate  to  a  pilot  on  mood-altering  medications. 
Norfluoxetine  is  a  metabolite  of  fluoxetine.  Cimetidine  (trade  name  Tagamet)  is  an  antiacid 
medication  available  over  the  counter.  Diltiazem  (trade  name  Cardizem)  is  a  prescription 
medication  often  prescribed  for  patients  with  angina  (chest  pain  due  to  blocked  arteries  in  the 
heart).  Possible  side  effects  include  low  blood  pressure  and  slowed  heart  rate,  both  of  which 
would  tend  to  reduce  resistance  to  G-induced  loss-of-consciousness  (G-LOC).  Cimetidine  is 
known  to  significantly  increase  the  blood  levels  of  diltiazem  when  both  medications  are  taken. 

It  is  possible  that  the  pilot’s  blood  level  of  diltiazem  increased  as  a  result  of  the 
concomitant  use  of  cimetidine,  and  that  a  relatively  high-bank  turn  then  resulted  in  enough 
acceleration  (G-loading)  to  induce  G-LOC  and  thereby  incapacitate  the  pilot.  The  situation  was 
greatly  aggravated  by  the  pilot’s  severe  coronary  artery  disease,  possibly  resulting  in 
incapacitation  due  to  a  sudden  cardiac  event. 

The  Safety  Board  has  investigated  two  other  accidents  in  which  pilots  with  cardiac 
problems  were  fatally  injured  after  performing  aerobatics.  On  June  15,  1976,  a  pilot  practicing 
aerobatic  maneuvers  in  Goldsby,  Oklahoma,  entered  an  uncontrolled  descent  and  crashed.  The 
Board  determined  the  probable  cause  of  the  accident  to  be  the  pilot’s  incapacitation  due  to  a 
preexisting  heart  condition,  which  made  him  more  susceptible  to  the  G-forces  of  aerobatic 
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maneuvers.  On  June  26,  1993,  a  pilot  was  performing  aerobatics  at  an  airshow  in  Concord,  New 
Hampshire,  when  he  entered  a  maneuver  that,  according  to  other  aerobatic  pilots,  was  unfamiliar 
to  them.  The  Safety  Board  determined  the  probable  cause  of  the  accident  to  be  the  “loss  of 
airplane  control  as  the  result  of  incapacitation.”2 3  An  autopsy  revealed  that  the  pilot  had  “severe 
atherosclerosis”  and  “an  old . . .  myocardial  infarction  scar.”  The  only  limitation  on  the  pilot’s 
medical  certificate,  however,  was  a  requirement  that  the  pilot  use  corrective  lenses  during  flight. 

On  May  7,  1980,  a  pilot  crashed  near  Olathe,  Kansas,  while  practicing  aerobatic 
maneuvers  in  a  Pitts  Special  S2S.4  As  a  result  of  its  investigation  of  the  accident,  the  Safety 
Board  recommended  that  the  FAA  issue  an  advisory  circular  detailing  the  physiological  effects  of 
G  forces  (Safety  Recommendation  A-81-48).  In  response,  the  FAA  issued  AC  91-61,  “A  Hazard 
in  Aerobatics:  Effects  of  G-Forces  on  Pilots.”  According  to  the  AC,  the  most  important 
biomedical  factor  in  aerobatic  flight  is  the  pilot’s  response  to  acceleration  (G-loading).  The  AC 
also  states  that  G-  tolerance  depends  on  an  individual’s  height,  age,  elasticity  of  blood  vessels, 
training,  the  responses  of  the  heart  and  blood  vessels,  and  general  health.  Further,  “a  well  tuned 
cardiovascular  system  seems  to  recover  more  rapidly  from  many  different  kinds  of  stress”  and 
“low  blood  pressure  . . .  lower(s)  G-tolerance.” 

Thousands  of  pilots  receive  special  issuance  certificates  for  heart-related  problems  each 
year.  As  an  illustration  of  the  numbers  involved,  three  of  the  heart-related  categories  are  for  high 
blood  pressure  (which  normally  does  not  require  special  issuance),  coronary  bypass  surgery,  and 
myocardial  infarction  (heart  attack).  According  to  the  Records  and  Correspondence  Section  of 
the  FAA  Aeromedical  Certification  Division,  as  of  December  31, 1997,  there  were  28,981  medical 
certificates  issued  to  pilots  with  high  blood  pressure  that  were  being  treated  by  medications: 
3,339  first-class  medical  certificates;  6,155  second-class  medical  certificates;  and  19,487  third- 
class  medical  certificates.  Of  the  medical  certificates  issued  to  pilots  who  had  undergone  coronary 
bypass  surgery,  164  were  first  class;  227  were  second  class;  and  2,305  were  third  class.  Of  the 
medical  certificates  issued  to  pilots  who  had  experienced  a  heart  attack,  203  were  first  class;  214 
were  second  class;  and  2,099  were  third  class. 

The  condition  of  the  heart  and  blood  vessels  is  an  important  factor  in  a  pilot’s  tolerance  of 
aerobatic  flight.  Such  flight  increases  the  risk  of  G-LOC  for  pilots  with  a  heart  condition  or  who 
take  medication  that  results  in  low  blood  pressure  or  low  heart  rate.  Further,  aerobatic  flight  also 
endangers  the  passengers  of  these  pilots  and  the  spectators  at  airshows,  where  aerobatic 
maneuvers  are  often  performed,  should  the  pilot  experience  G-LOC.  The  safety  of  these  pilots, 
their  passengers,  and  the  spectators  at  airshows  would  be  greatly  increased  by  ensuring  that  the 
pilots  who  perform  aerobatics  can  tolerate  the  unique  physiological  stresses  such  maneuvers  put 
on  their  bodies. 


2  NTSB  accident  file  3-3293. 

3  NTSB  Brief  of  Accident  NYC93FA127. 

4  NTSB  Brief  of  Accident  MKC80FA034. 
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FAR  67.401(d)(3)  states  that  the  Federal  Air  Surgeon  may  place  on  any  special  issuance 
medical  certificate  “any  operational  limitation  needed  for  safety.”  Aviation  Medical  Examiners 
routinely  enter  limitations  on  medical  certificates  for  pilots  who  require  corrective  lenses  to  meet 
applicable  standards  for  visual  acuity  or  who  do  not  meet  the  color  vision  standard.  The  Safety 
Board  believes  that  all  pilots  with  special  issuance  certificates  due  to  cardiac  conditions  that  could 
affect  their  G-tolerance  and  all  pilots  taking  medication  that  reduces  G-tolerance  should  be 
restricted  from  engaging  in  aerobatic  flight. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Restrict  all  pilots  with  special  issuance  certificates  due  to  cardiac  conditions  that 
could  affect  their  G-tolerance  from  engaging  in  aerobatic  flight.  (A-99-1) 

Restrict  all  pilots  taking  medication  that  reduces  G-tolerance  from  engaging  in 
aerobatic  flight.  (A-99-2) 


Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHM3DT, 
GOGLIA,  and  BLACK  concurred  in  these  recommendations. 


Chairman 


<^anSjC, 


National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  January  11,  1999 
In  reply  refer  to:  A-99-3 


Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  September  2,  1998,  at  2018  eastern  daylight  time,  Swissair  flight  111,1  a  McDonnell 
Douglas  MD-11  registered  as  HB-IWF,  departed  from  John  F.  Kennedy  International  Airport  in 
Jamaica,  New  York.  Swissair  flight  111  was  a  regularly  scheduled  passenger  flight  from  New 
York  to  Geneva,  Switzerland,  operating  under  the  provisions  of  14  Code  of  Federal  Regulations 
Part  129. 

About  56  minutes  after  departure  while  at  flight  level  330,  the  flightcrew  declared  “PAN 
PAN  PAN’2  and  advised  air  traflBc  control  (ATC)  of  smoke  in  the  cockpit.  The  flightcrew 
requested  to  divert  to  a  convenient  airport  and  was  cleared  direct  to  Halifax  International  Airport 
in  Nova  Scotia,  Canada.  About  11  minutes  after  the  report  of  smoke,  the  airplane’s  electrical 
systems  began  to  deteriorate.  The  flightcrew  then  declared  an  emergency,  and  communications 
between  ATC  and  the  flightcrew  ceased  shortly  thereafter.  Approximately  6  minutes  later,  at 
2231  Atlantic  daylight  time,3  the  airplane  crashed  into  the  Atlantic  Ocean  near  Peggy’s  Cove, 
Nova  Scotia,  Canada.  All  14  crewmembers  and  215  passengers  were  killed,  and  the  airplane  was 
destroyed.  The  Transportation  Safety  Board  of  Canada  (TSB)  is  in  charge  of  the  accident 
investigation,  and  the  National  Transportation  Safety  Board  is  participating  in  accordance  with  the 
provisions  of  Annex  13  to  the  Convention  on  International  Civil  Aviation. 

Approximately  85  percent  of  the  airplane’s  wreckage  has  been  recovered  to  date.  Examination 
of  the  wreckage  revealed  evidence  of  considerable  heat  damage  to  ceiling  areas  both  forward  and  aft  of 
the  cockpit  bulkhead.  This  damage  is  consistent  with  the  effects  of  a  fire.  Numerous  sections  of  wiring 
from  the  cockpit  overhead  area  also  exhibited  heat  damage  and  burned  insulation,  and  several  of  the 


2  ^he  flight  was  also  operating  as  Delta  Air  Lines  flight  111  under  a  code-sharing  agreement. 

According  to  the  Federal  Aviation  Administration’s  (FAA)  Aeronautical  Information  Manual,  the  signal 
“PAN-PAN”  is  used  for  an  urgency  condition. 

3  The  Atlantic  time  zone  is  1  hour  ahead  of  the  eastern  time  zone. 
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wires  from  those  sections  showed  evidence  consistent  with  electrical  arcing.  Although  some  of  the 
wires  exhibiting  arcing  characteristics  are  from  the  entertainment  system  that  is  unique  to  the  Swissair 
MD-1 1  fleet,  others  have  been  identified  as  original  MD-1 1  wires. 

On  December  22,  1998,  the  TSB  issued  Aviation  Safety  Advisory  980031-1  to  the  Safety 
Board  as  the  representative  of  the  MD-ll’s  State  of  Manufacturer;  a  copy  of  the  advisory  was  also 
sent  to  Switzerland’s  Aircraft  Accident  Investigation  Bureau,  Transport  Canada,  and  the  FAA.  The 
advisory  points  out  that  TSB  investigators  recovered  two  MD-1 1  electrical  bus  feed  wires  that  show 
signs  of  arcing.  The  two  wires  are  identified  as  the  left  emergency  alternating  current  bus  feed  wire 
(wire  number  B205-1-10)  and  the  left  emergency  direct  current  bus  feed  wire  (wire  number  B205-4-6). 
If  the  wires  were  in  place,  the  area  of  apparent  arcing  damage  would  be  located  approximately  2  inches 
aft  of  the  right  cutout  in  the  “tub”  that  encloses  the  overhead  circuit  breaker  panel.4  According  to  the 
advisory,  the  potential  safety  ramifications  appear  to  be  confined  only  to  the  MD-1 1  fleet. 

TSB  investigators  also  recovered  the  overhead  circuit  breaker  panel  and  the  upper  avionics 
circuit  breaker  panel.  Portions  of  each  panel  show  evidence  of  substantial  heat  damage.  The  avionics 
circuit  breaker  panel  is  located  along  the  right  side  of  the  cockpit  behind  the  first  officer's  seat,  but  the 
upper  portion  of  that  panel  extends  into  the  area  near  the  overhead  circuit  breaker  panel. 

In  addition,  TSB  investigators  participated  in  examinations  of  several  other  MD-1 1  airplanes 
that  concentrated  on  the  area  from  the  cockpit  to  station  600  (near  the  forward  doors  of  the  airplane). 
The  examinations  showed  the  following: 

•  chafed,  cracked,  broken,  and  cut  electrical  and  bonding  wires  in  several  areas,  including 
the  overhead  and  avionics  circuit  breaker  panels  and  the  forward  drop  ceiling  area  above 
the  left  (L)  1  and  right  (R)  1  doors  and 

•  inconsistencies  in  the  routing  of  wires  and  wire  bundles,  loose  terminal  connections, 
excessively  small  bend  radii,  unsealed  electrical  conduits,  and  open  smoke  barriers 
between  the  cockpit  and  cabin  areas. 

On  December  10,  1998,  the  FAA  issued  Airworthiness  Directive  98-25-11,  “McDonnell 
Douglas  MD-11  Series  Airplanes,”  requiring  a  one-time  inspection  above  the  LI  and  R1  doors  to 
address  the  wire  chafing  issue  discovered  as  part  of  the  accident  investigation.  Also  in  December  1998, 
Boeing  issued  two  MD-11  Alert  Service  Bulletins — MD-24A068  Revision  1  and  MD-25A194 
Revision  4 — which  address  the  specific  discrepancies  regarding  the  door  areas.  Further,  SR  Technics, 
on  behalf  of  Swissair  and  along  with  Boeing,  has  voluntarily  developed  an  engineering  order  that 
defines  a  comprehensive  inspection  of  the  wiring  in  the  forward  areas  of  the  Swissair  MD-1 1  airplanes. 
The  Safety  Board  understands  that  the  inspections  completed  to  date  have  not  uncovered  any 
discrepancies  that  warrant  regulatory  action. 

Although  the  apparent  electrical  arcing  on  Swissair  flight  1 1 1  has  not  been  determined  to  be  a 
source  of  a  fire,  and  Swissair’s  voluntary  inspections  of  its  MD-11  airplanes  have  not  uncovered 


4  The  overhead  circuit  breaker  panel  is  located  in  the  cockpit  ceiling  between  and  behind  the  pilot  seats.  The  tub  is 
a  fiberglass  enclosure  that  forms  a  cavity  for  the  overhead  circuit  breakers  and  associated  wiring.  The  wiring  is 
routed  through  oval  cutouts  located  in  the  left  and  right  aft  portions  of  the  tub. 
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serious  discrepancies,  the  Safety  Board  is  concerned  about  the  recent  discoveries  of  apparent  electrical 
arcing  damage  to  wiring  near  the  accident  airplane’s  overhead  and  avionics  circuit  breaker  panels,  the 
heat  damage  to  those  panels,  and  the  wiring  anomalies  discovered  in  TSB's  examination  of  MD-11 
airplanes. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Require,  on  an  expedited  basis,  an  inspection  of  all  MD-1 1  airplanes  for  discrepancies 
of  wiring  in  and  around  the  cockpit  overhead  circuit  breaker  panel  (including  the  area 
just  aft  of  the  tub  enclosure)  and  the  avionics  circuit  breaker  panel.  The  inspection 
should  include  examinations  for  loose  wire  connections,  inconsistent  wire  routings, 
broken  bonding  wires,  small  wire  bend  radii,  and  chafed  and  cracked  wire  insulation 
(A-99-3) 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHM3DT,. 
GOGLIA,  and  BLACK  concurred  in  this  recommendation. 

By:  Jim  Hall 

Chairman 


National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  January  19,  1999 

In  reply  refer  to:  A-99-4 


Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  August  31,  1998,  the  right  main  landing  gear  (MLG)  of  a  Boeing  727-200  airplane, 
operated  by  DHL  Worldwide  Express,  collapsed  after  an  emergency  landing  at  John  F.  Kennedy 
International  Airport  in  Jamaica,  New  York.  The  emergency  was  declared  after  an  unrelated 
No.  2  engine  failure.  The  flight  was  an  intended  scheduled  Title  14  Code  of  Federal  Regulation 
Part  121  cargo  flight  from  New  York  to  Cincinnati,  Ohio.  None  of  the  three  flightcrew  members 
or  the  two  jumpseat  passengers  were  injured,  and  the  airplane  sustained  substantial  damage  as  a 
result  of  the  accident. 

The  right  MLG  was  original  equipment  that  had  accumulated  44,554  flight  cycles  and 
50,861  flight  hours  in  28  years  and  6  months  of  service.  Postaccident  examination  of  the  airplane 
by  the  National  Transportation  Safety  Board  revealed  that  the  right  MLG  forward  trunnion 
bearing  support  fitting  lug  had  fractured  and  that  postfracture  loads  on  the  fitting  had  spread  the 
fracture  faces  apart  by  bending  the  outboard  side  of  the  lug. 

The  right  MLG  of  the  B-727  is  a  conventional,  two-wheel  landing  gear  with  three  support 
points:  the  forward  trunnion,  the  aft  trunnion,  and  the  side  strut  (see  figure  1).  A  trunnion  link  is 
mounted  between  the  shock  strut  and  the  rear  spar.  The  aft  end  of  the  trunnion  link  is  pinned  to 
the  shock  strut,  and  the  forward  end  pivots  in  a  spherical  bearing  mounted  in  the  forward  trunnion 
bearing  support  fitting.1  The  spherical  bearing  has  external  splines  that  are  used  for  locking  the 
bearing  assembly  and  retaining  it  within  the  support  fitting  lug.  The  splines  contact  a  portion  of 
the  inner  surface  of  the  lug,  leaving  the  gaps  between  the  splines  exposed  to  possible  corrosion. 
The  trunnion  bearing  support  fitting  is  a  round  housing  made  from  4330M  steel.  The  inner  bore 
of  the  housing  has  chrome  electroplating,  which  is  the  bore’s  primary  means  for  corrosion 
protection.  The  fitting  is  mounted  on  the  rear  spar  of  the  wing  with  high-strength  bolts. 


1  The  design  and  location  of  the  forward  trunnion  bearing  support  fitting  are  similar  for  all  B-727  series  airplanes. 
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Figure  1.  Boeing  111  Main  Landing  Gear  Assembly 

Examination  of  the  trunnion  bearing  support  fitting  at  the  Safety  Board’s  materials 
laboratory  revealed  corrosion  at  the  forward  edge  of  the  fitting’s  lug  in  many  of  the  exposed  areas 
between  the  bearing  splines.  Fatigue  cracking  emanated  from  two  locations  within  a  severely 
corroded  area,  and  intergranular  stress  corrosion  cracking  (SCC)  stemmed  from  the  fatigue 
cracking.  This  corroded  area  was  0.15-inch  wide  by  0.37-inch  long  by  0.07-inch  deep.  The 
fracture  was  caused  by  a  combination  of  fatigue  cracking  and  SCC. 

According  to  Boeing’s  records,  three  other  B-727  series  airplane  events  involving  the 
failure  of  a  MLG  forward  trunnion  bearing  support  fitting  have  occurred.  The  first  of  these 
failures,  which  involved  a  B-727  owned  by  Air  Portugal,  occurred  in  Frankfurt,  Germany,  in  July 
1988.  Heavy  corrosion  was  found  at  the  forward  edge  of  the  forward  trunnion  bearing  support 
fitting  lug  and  bore,  and  the  fracture  was  caused  by  intergranular  SCC.  The  other  two  failures, 
which  involved  B-727s  owned  by  Delta  Air  Lines,  occurred  in  Denver,  Colorado,  in  May  1989 
and  Albuquerque,  New  Mexico,  in  July  1997.  The  Safety  Board  investigated  both  of  these  cases 
and  found  that  heavy  surface  corrosion  on  the  forward  trunnion  bearing  support  fitting  lug  had 
caused  either  multiple  fatigue  regions  or  SCC. 

On  March  8,  1990,  Boeing  issued  Service  Bulletin  (SB)  727-57-0179  (revised  on  June  13, 
1991,  and  April  30,  1992),  recommending  (1)  ultrasonic  inspection  of  the  forward  trunnion 
bearing  support  fitting  for  SCC  at  least  every  6  months  or  1,500  flight  cycles,  whichever  occurs 
first,  and  (2)  magnetic  particle  inspection  at  12,000  cycle  intervals.  The  SB  states  that  the 
inspections  should  continue  until  the  fitting  is  replaced  or  the  specified  preventive  modification  of 
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the  fitting  is  performed.2  The  preventive  modification  includes  removing  the  fitting  from  the 
airplane,  performing  magnetic  particle  inspection,  cleaning,  and  installing  a  moisture  barrier 
Boeing  Material  Specification  5-95  sealant.  The  recommended  actions  of  the  SB  are  not  currently 
mandated  by  a  Federal  Aviation  Administration  (FAA)  airworthiness  directive.  As  a  result,  some 
operators  have  developed  their  own  visual  and  ultrasonic  inspections  that  are  performed  at 
intervals  up  to  every  30  months,  but  other  operators  do  not  perform  the  inspection  at  all.  DHL 
did  not  inspect  the  fitting  from  the  accident  airplane. 

The  Safety  Board  is  concerned  that  additional  B-727  forward  trunnion  bearing  support 
fittings  may  fail  because  of  corrosion,  fatigue,  and  SCC,  which  could  jeopardize  safety.  The 
Safety  Board  is  also  concerned  that  no  requirement  exists  for  recurrent  inspection  and  protection 
of  the  fitting  with  a  moisture  barrier.  Periodic  ultrasonic  inspection  is  necessary  to  detect 
corrosion,  cracks,  and  SCC  in  the  trunnion  fitting  so  that  the  part  can  be  repaired  or  replaced  or 
have  the  preventive  modification  performed.  Also,  the  application  of  a  proper  moisture  barrier  is 
important  to  minimize  the  possibility  of  corrosion  on  new  or  existing  fittings.  Therefore,  the 
Safety  Board  believes  the  FAA  should  require  operators  of  all  B-727  series  airplanes  to  (1) 
conduct  periodic  ultrasonic  inspections  of  the  MLG  forward  trunnion  bearing  support  fittings  for 
corrosion,  cracks,  and  SCC;  (2)  repair  or  replace  these  fittings  if  they  are  cracked  or  corroded; 
and  (3)  ensure  that  a  proper  moisture  barrier  is  applied  on  new  or  existing  MLG  forward  trunnion 
bearing  support  fittings  to  minimize  corrosion. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Require  operators  of  all  Boeing  727  series  airplanes  to  (1)  conduct  periodic 
ultrasonic  inspections  of  the  main  landing  gear  (MLG)  forward  trunnion 
bearing  support  fittings  for  corrosion,  cracks,  and  stress  corrosion  cracking; 

(2)  repair  or  replace  these  fittings  if  they  are  cracked  or  corroded;  and  (3) 
ensure  that  a  proper  moisture  barrier  is  applied  on  new  or  existing  MLG 
forward  trunnion  bearing  support  fittings  to  minimize  corrosion.  (A-99-4) 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMDDT, 
GOGLIA,  and  BLACK  concurred  in  this  recommendation. 
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If  cracked  or  corroded  fittings  are  repaired,  the  SB  states  that  the  inspections  may  need  to  continue  depending  on 
the  type  of  repair  performed. 


National  Transportation  Safety  Board 

Washington,  D.C.  20594 


Safety  Recommendation 


Date:  February  3,  1999 
In  reply  refer  to:  A-99-5  through  -7 


Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  October  12,  1997,  about  1728  Pacific  daylight  time,  an  experimental  category, 
amateur-built  Adrian  Davis1  Long-EZ  airplane,  N555JD,  crashed  into  the  Pacific  Ocean  near 
Pacific  Grove,  California.  Air  traffic  control  communications  indicated  that  the  airplane  had 
departed  from  the  Monterey  Peninsula  Airport’s  runway  28L  about  1712,  and  the  pilot  performed 
three  touch-and-go  landings  and  departed  to  the  west  moments  before  the  accident.  Witnesses 
reported  that  they  heard  engine  popping  and  a  reduction  in  engine  noise  before  the  accident.  The 
pilot  made  no  distress  calls.  The  pilot  was  killed,  and  the  airplane  was  destroyed. 

An  airport  maintenance  technician  helped  the  pilot  push  the  airplane  out  of  the  hangar 
before  the  accident  flight  and  was  present  during  the  preflight  check.  The  technician  said  he  told 
the  pilot  that  less  than  a  quarter  tank  of  fuel  was  available  in  the  left  tank  and  less  than  half  a  tank 
of  fuel  was  available  in  the  right  tank.  The  technician  estimated  the  fuel  quantity  based  on  the 
assumption  that  the  presentations  on  the  unmarked  sight  gauges  were  linear.  However,  Long-EZ 
fuel  tank  sight  gauges  are  not  linear,  and  examination  of  other  Long-EZ  sight  gauges  revealed 
that  the  actual  fuel  on-board  the  airplane  would  have  been  much  lower  than  the  technician’s 
estimate.  The  fuel  tank  sight  gauges  were  not  visible  from  the  front  cockpit.  The  technician 
loaned  the  pilot  a  shop  inspection  mirror  so  it  would  be  possible  for  the  pilot  to  see  the  fuel  tank 
sight  gauges  in  flight.  The  pilot  told  the  technician  that  he  did  not  wish  to  refuel  the  airplane. 

The  technician  said  he  heard  the  engine  start  and  run  for  a  short  time  and  quit.  Watching 
from  the  hangar,  he  saw  the  pilot  turn  in  the  front  cockpit  toward  the  fuel  selector  handle  behind 
his  left  shoulder.  Shortly  afterward,  the  technician  heard  the  engine  restarted.  The  pilot  signaled 
an  “okay”  to  the  technician  and  taxied  toward  the  runway.  After  the  airplane  departed  the  traffic 
pattern  to  the  west,  witnesses  reported  that  the  airplane  climbed  to  350  to  500  feet  and  was  in 


1  The  Federal  Aviation  Administration  (FAA)  issues  experimental  airworthiness  certificates  for  amateur-built  aircraft 
with  the  original  builder  s  name  as  the  manufacturer.  Any  subsequent  owner  may  change  the  registration  number  but 
not  the  Certificate  of  Airworthiness.  Hence,  the  builder’s  name  appears  on  the  Certificate  of  Airworthiness. 
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level  flight  when,  after  the  reduction  in  engine  noise,  it  pitched  slightly  nose-up,  entered  a  steep 
right  bank,  and  descended  nose-first  into  the  ocean. 

Safety  Board  investigators  determined  that  the  weight  and  center  of  gravity  of  the 
accident  airplane  were  within  the  original  planned  limits  for  the  Long-EZ  and  would  not  have 
affected  the  flight  or  stall  characteristics  of  the  airplane.  Based  on  the  airplane’s  fueling  history, 
the  technician’s  observations  of  the  fuel  levels  at  engine  start,  and  the  normal  fuel  consumption 
rates  of  the  airplane’s  Lycoming  O-320-E3D  engine,  the  airplane  would  have  had  about  3  1/2 
gallons  of  fuel  available  from  the  left  tank  and  about  6  1/2  gallons  of  fuel  available  from  the  right 
tank.  The  Safety  Board  found  that  witness  statements  were  consistent  with  the  checkout  pilot’s 
description  of  postflight  engine  shut-down2  and  concluded  that  the  engine  lost  power  because  of 
fuel  starvation  or  exhaustion.3 

The  Long-EZ  was  designed  by  Rutan  Aircraft  Factory  and  amateur-built  from  the  Rutan 
plans  as  a  single-engine,  tandem  cockpit,  swept-wing,  canard-equipped4  airplane  with  laminar 
flow  airfoils.5  The  engine  is  mounted  aft  of  the  cabin,  and  both  cockpits  have  pitch  and  roll  side- 
stick  controls. 

The  all-composite6  airplane  has  a  canard  with  elevators  for  pitch  control.  The  swept 
wings  have  taper  and  twist  and  have  winglets  installed  at  the  tips.  According  to  technicians  from 
the  Experimental  Aircraft  Association  (EAA),  the  rudder  system  used  in  the  Long-EZ  is  very 
sensitive7  in  low-speed  flight.  According  to  the  former  Rutan  chief  engineer,  the  airplane  has  a 
substantial  glide  ratio  due  to  its  aerodynamically  clean  design  but  will  pitch  up  and  roll  right 
when  the  airspeed  is  slow  and  the  right  rudder  is  depressed.  When  the  airspeed  is  higher,  he 
stated  that  roll  rates  are  much  higher  and  that  it  is  possible  to  aileron-roll  the  airplane  from 
rudder  application  only  (ailerons  neutral). 

According  to  the  Long-EZ  owner’s  manual,  the  airplane  has  good  flight  characteristics  at 
minimum  speed.  The  manual  describes  “stalls”  as  maneuvers  that  result  in  increased  aft  stick 
force  or  mild  pitch  or  roll  oscillations.  Spin  attempts  result  in  a  spiral  that  reportedly  can  be 
recovered  by  neutralizing  rudder  and  pulling  out  normally.  The  Long-EZ  design  incorporates 
many  high  performance  features  but  would  not  be  considered  “high  performance”  by  Federal 


2  The  checkout  pilot  told  Safety  Board  investigators  that  when  the  engine  was  stopped  by  closing  the  mixture 
(shutting  off  the  fuel  supply)  at  the  end  of  a  flight,  loud  popping  normally  occurred. 

3  For  more  information,  see  Brief  of  Accident  #LAX98FA008  (enclosed). 

4  A  canard  is  a  lifting  airfoil  located  in  the  front  portion  of  an  airplane  that  eliminates  the  need  for  a  tail-mounted 
horizontal  stabilizer. 

5  Laminar  flow  airfoils  are  used  in  high  performance,  complex  aircraft  such  as  the  Beech  Starship.  The  airfoil 
construction  minimizes  drag  but  is  sensitive  to  boundary  layer  separation  (stall). 

6  The  Long-EZ  airplane  is  constructed  of  shaped  foam  and  fiberglass/epoxy  materials. 

7  The  rudder  system  in  the  Long-EZ  comprises  two  independent,  outward  acting  rudders  on  the  rear  of  the  winglets. 
Activation  in  low  speed  flight  is  very  easy;  however,  the  owners  manual  cautions  against  inadvertent  use  because  a 
substantia]  yaw  will  result. 
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Aviation  Administration  (FAA)  definition8  because  the  airplane  has  no  flaps  or  controllable  pitch 
propeller.  Nonetheless,  its  laminar  flow  airfoils  have  greater  lift-to-drag  ratios  than  most  general 
aviation  airplanes.  Because  the  airplane  has  no  flaps,  its  landing  speeds  are  greater  than  many 
small  airplanes,  and  it  has  a  wings  level,  power  off  stall  speed  of  about  7 1  mph.9 

The  Long-EZ  airplane  has  two  26-gallon  fuel  tanks,  one  at  each  wing  root.  Fuel  quantity 
is  determined  by  viewing  the  rear  cockpit  sight  gauges.  N555JD  was  also  equipped  with  a  fuel 
totalizer.  Fuel  is  selected  from  the  left  or  the  right  tank  by  turning  a  fuel  selector  handle. 
According  to  the  Rutan  design,  the  fuel  selector  handle  is  to  be  located  just  aft  of  the  nose  wheel 
position  window  between  the  pilot’s  legs  and  is  oriented  toward  the  right  to  select  the  right  tank, 
left  to  select  the  left  tank,  and  another  quarter  turn  to  the  left  to  select  the  “Off’  position.  A 
placard  associated  with  the  Rutan  design  clearly  identifies  the  fuel  selector  handle  positions. 

The  amateur  builder  of  N555JD  modified  the  fuel  system  design  by  locating  the  fuel 
selector  handle  on  the  left  side  of  the  bulkhead  that  forms  the  front  cockpit  seat  back.  It  was 
positioned  approximately  behind  the  front-seat  pilot’s  left  shoulder  (see  figure  1).  The  builder 
also  changed  the  orientation  of  the  handle  so  that  upward  selected  “Off,”  right  selected  the  left 
tank,  and  downward  selected  the  right  tank.  The  corresponding  3-position  fuel  selector  valve 
was  installed  inside  the  rear  cockpit  on  the  front  of  the  engine  firewall  just  behind  the  rear  seat 
and  was  connected  to  the  selector  handle  via  two  torque  tubes  and  a  universal  joint.  The  selector 
handle  was  about  4  feet  forward  of  the  fuel  selector  valve.  No  placard  or  marking  existed  (nor 
was  it  required)  on  the  fuel  selector  handle  base  that  would  have  indicated  to  the  pilot  its 
operating  position.  Further,  as  has  been  stated,  the  sight  gauges  were  not  marked  to  quantify  the 
amount  of  fuel  in  the  tanks. 


The  FAA  defines  “high  performance”  as  an  airplane  that  has  an  engine  with  greater  than  200  horsepower  or  that 
has  retractable  landing  gear,  flaps,  and  a  controllable  pitch  propeller  (14  Code  of  Federal  Regulations  (CFR)  Part 
61.31  (e)). 

1QThe  maximum  stall  speed  allowed  for  aircraft  certificated  under  14  CFR  Part  23  is  61  knots  (70  mph). 

Although  the  accident  airplane  was  equipped  with  sight  gauges,  which  were  part  of  the  original  design,  it  also  had 
a  fuel  totalizer  installed  in  the  front  instrument  panel  that  required  pilot  entry  of  the  starting  fuel  amount.  Witness 
statements  provide  no  evidence  that  the  totalizer  was  used,  and  the  checkout  pilot  stated  he  was  not  familiar  with  it 
and  did  not  provide  any  instruction  on  its  use. 
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Figure  1 — Comparison  of  fuel  selector  handle  locations  in  Long-EZ 
N555JD  vs.  Original  design 

The  flight  control  side  sticks  in  both  cockpits  were  installed  in  armrests  on  the  right  side 
of  the  cockpits,  measured  about  6  inches  high,  and  were  similar  in  function  to  a  conventional 
control  stick.  During  the  postaccident  investigation,  simulation  by  Safety  Board  staff  showed 
that  the  front-seat  pilot  in  the  accident  airplane  would  have  had  to  loosen  his  shoulder  harness, 
completely  release  the  flight  control  stick,  turn  in  his  seat,  and  stretch  to  his  left  when  reaching 
over  the  left  shoulder  with  his  right  hand  to  change  the  position  of  the  fuel  selector  handle  on  the 
accident  Long-EZ  airplane.  The  Safety  Board  investigator,  in  every  simulation,  inadvertently 
applied  right  rudder  when  turning  his  body  and  reaching  for  the  fuel  selector  handle.  This 
finding  concerned  the  Safety  Board  because  the  design  change  that  moved  the  fuel  selector 
handle  introduced  a  safety  hazard  in  N555JD.  On  the  basis  of  the  accident  circumstances  and 
witness  accounts,  the  Board  concluded  that  the  accident  pilot  probably  inadvertently  applied  right 
rudder  while  manipulating  the  fuel  selector,  precipitating  the  loss  of  control  that  preceded  the 
accident. 

The  fuel  selector  valve  assembly  from  the  accident  airplane  was  found  in  an  intermediate 
position;  the  selector  valve  port  from  the  right  tank  fuel  supply  line  was  about  33  percent  open  to 
the  engine  feed  line  and  the  left  was  about  2  to  4  percent  open  to  the  engine  feed  line.  An  engine 
test  run  in  a  test  cell  showed  that  full  power  could  be  attained  (with  fuel  in  both  tanks)  with  the 
selector  valve  in  the  “as  found”  position.  However,  with  fuel  in  only  one  tank  and  the  other  fuel 
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line  open  to  the  atmosphere  to  simulate  an  empty  tank,  the  engine  lost  power  with  the  fuel 
selector  valve  in  the  “as  found”  position.  The  position  of  the  fuel  selector  handle  from  the 
accident  airplane  could  not  be  determined  because  of  damage  to  the  torque  tubes  between  the 
valve  and  the  selector  handle. 

Postaccident  examination  of  the  engine  revealed  no  mechanical  failures,  and  internal 
continuity  of  the  drive  train  components  was  established.  The  magneto"  was  tested  and 
produced  a  normal  spark.  The  fuel  lines  had  no  leaks  or  blockages.  The  evidence  indicated  that 
the  engine  was  capable  of  producing  normal  power  if  sufficient  fuel  was  supplied  to  it. 

The  Safety  Board  determined  that  the  probable  cause  of  the  accident  was  the  pilot’s 
diversion  of  attention  from  the  operation  of  the  airplane  and  his  inadvertent  application  of  right 
rudder  that  resulted  in  the  loss  of  airplane  control  while  attempting  to  manipulate  the  fuel 
selector  handle.  Also,  the  Board  determined  that  the  pilot’s  inadequate  preflight  planning  and 
preparation,  specifically  his  failure  to  refuel  the  airplane,  was  causal.  The  Board  determined  that 
the  builder’s  decision  to  locate  the  unmarked  fuel  selector  handle  in  a  hard-to-access  position, 
unmarked  fuel  quantity  sight  gauges,  inadequate  transition  training  by  the  pilot,  and  his  lack  of 
total  experience  in  the  type  of  airplane  were  factors  in  the  accident. 

N555JD  had  a  special  airworthiness  certificate  in  the  experimental  category12  that  was 
issued  on  May  5,  1987.  The  airplane  had  been  flown  about  850  hours  and  had  been  sold  two 
times  since  its  construction.  Because  N555JD  was  an  experimental,  amateur-built  airplane, 
specific  deviations  from  the  original  plans  did  not  require  FAA  approval  nor  was  a  placard 
required  to  identify  fuel  selector  valve  positions  or  to  indicate  that  there  had  been  a  change  in  the 
airplane  s  design.  However,  the  overall  design  is  evaluated  for  safety  and  airworthiness  by  the 
FAA  prior  to  issuing  the  experimental  airworthiness  certificate. 

The  Safety  Board  is  concerned  that  the  pilot  of  N555JD,  who  had  minimal13  pilot-in- 
command  experience  in  the  accident  airplane,  may  not  have  been  adequately  familiar  with  the 
operating  positions  of  the  unmarked  fuel  selector  handle.  This  is  of  special  concern  because  in 
its  modified  location  and  orientation,  the  fuel  selector  handle’s  operating  positions  would  have 
been  less  intuitively  obvious  than  if  it  had  been  installed  as  originally  designed.  Also, 
demonstrations  indicated  that  the  fuel  selector  handle  was  out  of  the  accident  pilot’s  view  and  in 
an  awkward  position  that  a  pilot  of  similar  height  as  the  accident  pilot  (5’  10”)  could  not  operate 
without  releasing  the  flight  control  stick.  An  interview  with  the  checkout  pilot  revealed  that  he 


11  This  engine  had  one  magneto  and  one  electronic  ignition  installed.  The  spark  plugs  showed  evidence  of  normal 
ignition,  and  the  magneto  functioned  normally  when  its  impulse-coupling  was  rotated  by  hand.  The  electronic 
ignition  was  not  tested. 

Title  14  CFR  21.191  “Experimental  Certificates,”  allows  experimental  airworthiness  certificates  to  be  issued  for, 
among  other  purposes,  the  operation  of  amateur-built  aircraft.  Amateur-built  aircraft  are  not  required  to  meet  the 
standardized  certification  requirements  contained  in  Part  23. 

Safety  Board  investigators  determined  that  the  accident  pilot  had  about  70  minutes  of  pilot-in-command 
experience  in  this  model  airplane,  not  including  the  accident  flight.  The  pilot’s  flight  experience  will  be  discussed 
later  in  this  recommendation  letter. 
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had  avoided  this  problem  by  planning  his  flights  in  the  airplane  such  that  he  never  needed  to 
operate  the  fuel  selector  valve  handle  in  flight. 

Safety  Board  investigators  found  that  there  are  numerous  experimental  category  airplanes 
that  are  flown  without  placards  and  markings  on  cockpit  instruments  and  essential  system 
controls,  such  as  the  fuel  selector  handle.  Further,  essential  cockpit  controls,  including  fuel 
selectors  in  amateur-built  airplanes,  are  not  required  to  be  in  standardized  locations.  The  Board 
is  concerned  that  pilots  inexperienced  in  such  airplanes  may  find  it  difficult  to  operate  them 
without  type-specific  training  (type-specific  training  will  be  discussed  later  in  this 
recommendation  letter).14 

FAA  Order  8130.2C,  “Airworthiness  Certification  of  Aircraft  and  Related  Products,” 
provides  guidance  to  FAA  aviation  safety  inspectors  regarding  the  issuance  of  special 
airworthiness  certificates  and  operating  limitations  for  experimental  aircraft.  Paragraph  88(b)  of 
this  order  describes  inspections  necessary  to  obtain  special  airworthiness  certificates.  It  indicates 
that  all  instruments  should  be  marked  according  to  the  approved  flight  manual.  Advisory 
Circular  (AC)  20-27D  “Certification  and  Operation  of  Amateur-Built  Aircraft,”  provides 
guidance  to  pilots  on  building,  certifying,  and  operating  amateur-built  aircraft  and  describes  the 
FAA’s  role  in  the  certification  process.  Paragraph  12  of  AC  20-27D  states  that  the  applicant 
should  expect  the  FAA  inspector  or  the  designated  airworthiness  representative  (DAR)  to 
verify  that  all  required  markings  are  properly  applied.  The  FAA  order  and  the  AC,  however,  do 
not  explicitly  require  the  inspection  of  placards  or  markings  in  the  cockpit  before  issuing  special 
airworthiness  certificates.  They  also  do  not  provide  adequate  guidance  or  evaluation  concerning 
the  inspection  of  the  placement  or  operation  of  essential  controls.  Because  accident  data  from  a 
Safety  Board  study  suggest  that  the  ergonomics  of  cockpit  control  placement  can  be  critical  in  the 
safe  operation  of  airplanes,16  the  Board  is  concerned  that  a  lack  of  requirements  for  standardized 
placards,  markings,  or  appropriate  placement  of  essential  system  controls  could  jeopardize  flight 
safety  in  experimental,  amateur-built  airplanes.  Therefore,  the  Safety  Board  believes  that  the 
FAA  should  amend  FAA  Order  8130.2C  to  specify  that,  before  the  issuance  of  special 
airworthiness  certificates,  experimental,  amateur-built  airplanes  should  be  inspected  for  needed 
placards  and  markings  on  cockpit  instruments  and  for  the  appropriate  placement  and  operation  of 


14  Safety  Board  staff  found  that  the  Glasair  training  syllabus  directed  the  pilot  to  answer  multiple  questions 
concerning,  among  other  subjects,  fuel  system  descriptions,  operations,  and  emergency  procedures. 

**  DARs  are  private  persons  designated  by  the  FAA  to  act  in  its  behalf  in  the  inspection  of  aircraft  and  to  issue 
airworthiness  certificates. 

16  A  1974  NTSB  special  study,  U.S.  General  Aviation  Accidents  Involving  Fuel  Starvation  (AAS-74-01)  analyzed 
fuel  starvation  aircraft  accidents  from  1970  through  1972.  Among  the  recommendations  in  the  report,  which  were 
intended  to  reduce  the  number  of  fuel  starvation  accidents,  the  Safety  Board  asked  the  FAA  to  amend  14  CFR  Part 
23  to  include  specifications  for  standardizing  fuel  selector  valve  designs,  displays,  and  modes  of  operation 
(A-74-39).  This  recommendation  was  classified  “Closed — Acceptable  Action”  after  the  FAA  changed  Part  23. 
Currently,  14  CFR  Part  23.777  addresses  the  physical  placement  of  controls  and  states  that  "each  fuel  feed  selector 
control  must.. .be  located  and  arranged  so  that  the  pilot  can  see  and  reach  it  without  moving  any  seat  or  primary  flight 
control  when  his  seat  is  at  any  position  in  which  it  can  be  placed."  The  mapping  of  fuel  selector  control  positions  in 
accordance  with  natural  expectations  is  addressed  in  14  CFR  Part  23.779,  which  requires  that  fuel  selector  control 
movement  be  consistent  with  tank  selection  (i.e.,  left  for  left  tanks;  right  for  right  tanks). 
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essential  system  controls  to  ensure  that  they  provide  clear  marking,  easy  access,  and  ease  of 
operation. 

The  Safety  Board  notes  that  the  requirement  for  an  annual  inspection  (referred  to  as  a 
condition  inspection)17  of  experimental,  amateur-built  airplanes  is  contained  in  a  limitations 
letter  attached  to  the  special  certificate  of  airworthiness.18  Paragraphs  141  and  142  of  Order 
8130.2C  generally  describe  the  issuance  of  experimental  operating  limitations,19  which  always 
include  the  inspection  requirements.  The  operating  limitations  state  that  the  condition  inspection 
shall  be  recorded  in  the  aircraft  maintenance  records  in  accordance  with  the  scope  and  detail  of 
14  CFR  Part  43,  Appendix  D  or  other  FAA-approved  programs  and  that  the  condition  inspection 
is  equivalent  to  an  annual  inspection. 

The  operations  limitations  may  require  the  use  of  placards  and  markings  to  ensure  the 
safe  operation  of  the  aircraft.  The  Safety  Board  is  not  aware  of  any  recurrent  requirement  to 
inspect  placards  and  markings  in  the  cockpit  and  on  essential  system  controls  to  ensure  that  they 
display  appropriate  and  accurate  information. 

The  Safety  Board  is  concerned  about  the  lack  of  requirements  to  periodically  inspect  the 
placards,  markings,  and  essential  controls  in  experimental,  amateur-built  aircraft.  Periodic 
inspection  of  these  items  is  necessary  to  ensure  that  they  consistently  display  appropriate  and 
accurate  information  to  the  pilot  for  flight  safety.  Therefore,  the  Safety  Board  believes  that  the 
FAA  should  amend  FAA  Order  8130.2C  to  specify  that  inspection  limitations  be  issued  with 
special  airworthiness  certificates  for  amateur-built  airplanes  requiring  that  the  annual  condition 
inspection  include  an  inspection  for  needed  placards  and  markings  on  cockpit  instruments  and 
the  appropriate  operation  of  essential  controls  to  ensure  that  they  provide  clear  marking,  easy 
access,  and  ease  of  operation. 

Another  concern  of  the  Safety  Board  was  the  limited  amount  of  transition  training 
received  by  the  accident  pilot  in  the  accident  airplane.  A  review  of  the  pilot’s  FAA  airman  and 
medical  records  indicated  that  he  held  a  private  pilot  certificate  with  airplane  ratings  for  single 
and  multiengine  land,  single-engine  sea,  instrument  airplane,  glider,  and  a  Lear  Jet  type  rating. 
The  pilot’s  logbook  was  not  recovered  after  the  accident;  however,  his  total  flight  time  reported 
on  his  last  physical  was  2,750  hours,  including  15  hours  in  the  preceding  6  months.  The  Safety 
Board’s  investigation  revealed  that  the  pilot  purchased  the  accident  airplane  on  September  27, 
1997,  and  that  his  pilot-in-command  experience  in  the  airplane  was  limited  to  a  1/2-hour  ground 
and  flight  checkout  on  the  day  before  the  accident  and  a  1-hour  solo  flight.  According  to  an  air 
traffic  control  communication  tape,  the  duration  of  the  checkout  flight  was  only  10  minutes,  and 
the  pilot  departed  about  20  minutes  later  for  a  1-hour  solo  flight  to  his  home  airport.  The  Safety 
Board  learned  that  the  pilot  had  been  on  three  previous  demonstration  flights  in  Long-EZ 
airplanes  (during  all  of  which  he  occupied  the  rear  seat)  but  could  not  determine  how  much,  if 


Condition  inspection  is  defined  in  the  Airworthiness  Inspector’s  Handbook,  FAA  Order  8300.10,  Chapter  25. 

The  limitations  letter  lists  requirements  for  continued  airworthiness. 

The  operating  limitations  are  designed  for  each  aircraft.  The  FAA  inspector  may  impose  any  operational 
limitations  deemed  necessary  in  the  interest  of  safety. 
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any,  pilot  training  he  received  during  these  flights.20  The  Safety  Board  found  no  evidence  of  the 
pilot  having  any  other  flight  experience  in  Long-EZ  airplanes. 

On  the  basis  of  his  limited  flight  experience  in  this  type  of  airplane,  the  Safety  Board 
concludes  that  the  pilot  likely  did  not  have  the  necessary  knowledge  and  skills  to  efficiently 
operate  it  during  the  emergency  circumstances  of  the  accident  flight.  Had  the  pilot  been  more 
skilled  in  the  operation  of  the  flight  controls  and  knowledgeable  of  the  unusual  fuel  selector,  the 
accident  might  have  been  avoided  or  the  severity  of  the  accident  could  have  been  reduced. 

The  Safety  Board  is  aware  that  some  advanced,22  experimental,  amateur-built  airplane 
training  organizations  have  published  training  syllabi.  The  Safety  Board  also  notes  that  insurers 
of  amateur-built  airplanes,  similar  to  or  more  advanced  than  the  Long-EZ,  have  sometimes 
required  a  training  syllabus  and  detailed  aircraft  inspection  as  conditions  for  providing  insurance 
coverage  for  the  pilot/owner.  The  Safety  Board  has  found  that  the  accident  rates  for  high 
performance,  complex,  and  unusual  aircraft  may  be  substantially  reduced  by  requiring 
pilot/owner-operators  to  undergo  type-specific  ground  and  flight  training.  For  example,  it  was 
found  that  when  formal  flight  and  ground  training  was  required  for  pilots  of  Piper  PA-46  Malibu 
airplanes,  the  fatal  accident  rate  in  that  airplane  model  was  reduced.24  Further,  the  Aviation 
Insurance  Association  (AIA)  has  reported  that  using  and  closely  adhering  to  a  specified  training 
syllabus  has  considerably  reduced  the  accident  rate  in  the  Glasair  and  Lancair  experimental, 
amateur-built  airplanes.25  Additionally,  the  Safety  Board  found  accident  rates  of  Robinson  R22 
helicopters  were  substantially  reduced  when,  in  response  to  the  Safety  Board  s  recommendations, 
the  FAA  issued  Special  Federal  Aviation  Regulation  (SFAR)  73  on  February  23,  1995, 


20  According  to  the  Rutan  engineer  who  gave  the  first  demonstration  flight,  the  pilot  said  he  had  no  previous  flights 
in  Long-EZ  airplanes.  Only  one  demonstration  flight  was  in  N555JD. 

21  The  in-flight  manipulation  of  the  fuel  selector,  the  location  and  accuracy  of  the  fuel  quantity  sight  gauges,  and 
using  the  installed  fuel  totalizer  probably  would  have  been  included  in  formalized  transition  training. 

22  “Advanced”  experimental  airplanes  are  typically  faster,  aerodynamically  cleaner,  and  are  more  complex  than  most 
amateur-built  aircraft.  The  Safety  Board  staff  found  three  companies  that  sell  kits  for  experimental,  amateur-built 
airplanes  and  that  provide  formal,  type-specific  ground  and  flight  training  to  the  owner/pilots  of  these  airplanes.  The 
Glasair  training  plan  provides  for  approved  certificated  flight  instructors  located  in  different  areas  of  the  country  that 
will  conduct  the  formal  course  of  instruction  to  the  pilot.  The  Lancair  plan  provides  ground  instruction  at  its  factory 
and  provides  a  factory  test  pilot  to  fly  at  the  builder’s  location  in  the  builder’s  airplane  through  the  first  10  hours  of 
the  flight  test  program.  The  Velocity  plan  has  east  and  west  coast  centers  that  provide  formal  ground  and  flight 
instruction.  Safety  Board  staff  found  that  each  company,  in  conjunction  with  insurers,  mandates  its  specific  course 
of  training.  Each  of  these  formal  programs  provides  certification  to  the  insurers  of  the  experimental,  amateur-built 
airplane  when  pilots  complete  the  prescribed  training. 

23  According  to  the  AIA,  accident  rates  for  the  Glasair  and  Lancair  airplanes  have  dramatically  dropped  because  of 
insurers  requiring  pilots’  use  of  type-specific  training  syllabi. 

24  A  spokesman  for  AVEMCO  (a  major  aircraft  insurer)  reported  to  the  Safety  Board  that,  as  a  condition  of 
insurance,  his  company  requires  that  all  PA-46  pilots  (and  pilots  of  other  pressurized  airplanes)  attend  formal 
training  that  includes  completion  of  a  type-specific  training  syllabus.  These  programs  reportedly  reduced  the 
accident  rates  of  these  airplanes.  The  Safety  Board’s  accident  data  show  no  PA-46  fatal  accidents  during  1992  and 
1997,  1  in  1993,  2  in  1998,  and  3  in  1994,  1995,  and  1996,  respectively.  None  of  the  accidents’  probable  causes  is 
attributed  to  inadequate  transition  training. 

25  The  AIA  has  reported  that  by  requiring  type-specific  transition  training  in  conjunction  with  the  airplane 
manufacturer,  the  accident  rates  for  those  aircraft  were  significantly  lowered. 
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promulgating  special  training,  proficiency,  and  operational  rules  for  pilots  operating  these 
helicopters.26  The  SFAR  required  specific  training  in  this  highly  responsive  helicopter  before  a 
pilot  could  operate  it  as  the  pilot-in-command. 

A  1998  query  showed  that  the  FAA’s  aircraft  database  contains  about  20,244 
experimental,  amateur-built  aircraft,  including  1,200  Long-EZ  airplanes.27  According  to  the 
EAA,  about  8,000  additional  aircraft  were  in  the  process  of  being  built  by  amateur  builders  in 
1997,  and  in  the  next  few  years,  a  significant  number  of  amateur-built  airplanes  will  be  sold  to 
non-builders.  As  previously  mentioned,  experimental,  amateur-built  aircraft  are  not  required  to 
be  certificated  to  14  CFR  Part  23  certification  standards  and,  therefore,  may  well  have  control 
locations,  functions,  and  markings  that  do  not  conform  to  the  original  design  plans.  Because  of 
these  and  other  differences  (such  as  performance  and  handling  characteristics)  between 
experimental,  amateur-built  aircraft  and  Part  23  aircraft,  quality  transition  training28  of  pilots 
flying  them  is  critical  to  their  safe  operation. 

The  Safety  Board  is  aware  of  the  EAA’s  Flight  Advisor  Program,  which  is  designed  to 
help  amateur  airplane  builders  safely  perform  their  first  flight.  In  this  program,  advisors  with 
substantial  flying/building  experience  offer  free  advice,  videos,  and  written  guidance  to  help 
make  builders’  first  test  flight  a  safe  one.  The  advisors  do  not  provide  flight  training  but  offer 
training  suggestions  and  options  for  the  pilot  to  consider.  This  program,  which  the  EAA  claims 
has  resulted  in  reduced  first-flight  accident  rates,29  is  generally  known  among  EAA  members  but 
not  among  the  general  pilot  population. 

Such  programs  can  provide  an  added  margin  of  safety  for  pilots  inexperienced  in  the 
operation  of  unusual  or  unique,  non-Part  23 -certificated  aircraft.  Unfortunately,  no  FAA  ACs, 
pamphlets,  or  programs  exist  that  require  or  encourage  pilots  who  did  not  build  their 
experimental  category  airplanes  to  receive  type-specific  transition  flight  training.  FAA 
publications  and  programs  also  lack  emphasis  on  the  benefits  of  formalized  syllabi  for  such 
transition  training.  The  Safety  Board  concludes  that  an  expanded  flight  advisor  program  could 
substantially  reduce  the  experimental,  amateur-built  airplane  accident  rate.  Therefore,  the  Safety 
Board  believes  that  the  FAA  should  establish,  in  conjunction  with  the  EAA  and  the  AIA,  a 
cooperative  program  that  strongly  encourages  pilots  transitioning  to  unusual  or  unfamiliar 
amateur-built,  experimental  category  airplanes  to  undergo  formalized,  type-specific  transition 
training  similar  to  that  provided  to  pilots  of  some  advanced,  experimental,  amateur-built 
airplanes. 


26  _  ... 

For  more  information,  see  NTSB  Special  Investigation  Report,  NTSB/SIR-96/03,  Robinson  Helicopter  Company 
R22  Loss  of  Main  Rotor  Control  Accidents,  dated  April  2,  1996. 

According  to  the  EAA,  4,500  Long-EZ  plans  were  sold.  The  EAA  estimates  that  about  95,000  plans  or  kits  have 
been  sold  to  prospective  amateur  builders  of  all  aircraft  types  in  the  past  10  years. 

The  Safety  Board  considers  quality  transition  training  to  be  type-specific,  formal  transition  training  that  adheres  to 
a  training  syllabus. 

The  EAA  has  reported  significant  accident  rate  reductions  since  the  Flight  Advisor  program  was  started  in  1995. 
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Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Amend  FAA  Order  8130.2C  to  specify  that,  before  the  issuance  of  special 
airworthiness  certificates,  experimental,  amateur-built  airplanes  should  be 
inspected  for  needed  placards  and  markings  on  cockpit  instruments  and  for  the 
appropriate  placement  and  operation  of  essential  system  controls  to  ensure  that 
they  provide  clear  marking,  easy  access,  and  ease  of  operation.  (A-99-5) 

Amend  FAA  Order  8130.2C  to  specify  that  inspection  limitations  be  issued 
with  special  airworthiness  certificates  for  amateur-built  airplanes  requiring 
that  the  annual  condition  inspection  include  an  inspection  for  needed  placards 
and  markings  on  cockpit  instruments  and  the  appropriate  operation  of  essential 
controls  to  ensure  that  they  provide  clear  marking,  easy  access,  and  ease  of 
operation.  (A-99-6) 

Establish,  in  conjunction  with  the  Experimental  Aircraft  Association  and  the 
Aviation  Insurance  Association,  a  cooperative  program  that  strongly 
encourages  pilots  transitioning  to  unusual  or  unfamiliar  amateur-built, 
experimental  category  airplanes  to  undergo  formalized,  type-specific  transition 
training  similar  to  that  provided  to  pilots  of  some  advanced,  experimental, 
amateur-built  airplanes.  (A-99-7) 

Also  as  a  result  of  its  investigation,  the  Safety  Board  issued  Safety  Recommendations 
A-99-8  to  the  AIA  and  A-99-9  to  the  EAA. 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMIDT, 
GOGLIA,  and  BLACK  concurred  in  these  recommendations. 
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National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  February  3,  1999 
In  reply  refer  to:  A-99-8 


Mr.  John  Donica 
Executive  Director 
Aviation  Insurance  Association 
899  South  College  Mall  Road,  #375 
Bloomington,  Indiana  47401 


On  October  12,  1997,  about  1728  Pacific  daylight  time,  an  experimental  category, 
amateur-built  Adrian  Davis1  Long-EZ  airplane,  N555JD,  crashed  into  the  Pacific  Ocean  near 
Pacific  Grove,  California.  Air  traffic  control  communications  indicated  that  the  airplane  had 
departed  from  the  Monterey  Peninsula  Airport’s  runway  28L  about  1712,  and  the  pilot  performed 
three  touch-and-go  landings  and  departed  to  the  west  moments  before  the  accident.  Witnesses 
reported  that  they  heard  engine  popping  and  a  reduction  in  engine  noise  before  the  accident.  The 
pilot  made  no  distress  calls.  The  pilot  was  killed,  and  the  airplane  was  destroyed. 

An  airport  maintenance  technician  helped  the  pilot  push  the  airplane  out  of  the  hangar 
before  the  accident  flight  and  was  present  during  the  preflight  check.  The  technician  said  he  told 
the  pilot  that  less  than  a  quarter  tank  of  fuel  was  available  in  the  left  tank  and  less  than  half  a  tank 
of  fuel  was  available  in  the  right  tank.  The  technician  estimated  the  fuel  quantity  based  on  the 
assumption  that  the  presentations  on  the  unmarked  sight  gauges  were  linear.  However,  Long-EZ 
fuel  tank  sight  gauges  are  not  linear,  and  examination  of  other  Long-EZ  sight  gauges  revealed 
that  the  actual  fuel  on-board  the  airplane  would  have  been  much  lower  than  the  technician’s 
estimate.  The  fuel  tank  sight  gauges  were  not  visible  from  the  front  cockpit.  The  technician 
loaned  the  pilot  a  shop  inspection  mirror  so  it  would  be  possible  for  the  pilot  to  see  the  fuel  tank 
sight  gauges  in  flight.  The  pilot  told  the  technician  that  he  did  not  wish  to  refuel  the  airplane. 

The  technician  said  he  heard  the  engine  start  and  run  for  a  short  time  and  quit.  Watching 
from  the  hangar,  he  saw  the  pilot  turn  in  the  front  cockpit  toward  the  fuel  selector  handle  behind 
his  left  shoulder.  Shortly  afterward,  the  technician  heard  the  engine  restarted.  The  pilot  signaled 
an  “okay”  to  the  technician  and  taxied  toward  the  runway.  After  the  airplane  departed  the  traffic 


1  The  Federal  Aviation  Administration  (FAA)  issues  experimental  airworthiness  certificates  for  amateur-built  aircraft 
with  the  original  builder’s  name  as  the  manufacturer.  Any  subsequent  owner  may  change  the  registration  number  but 
not  the  Certificate  of  Airworthiness.  Hence,  the  builder’s  name  appears  on  the  Certificate  of  Airworthiness. 


7114 


2 


pattern  to  the  west,  witnesses  reported  that  the  airplane  climbed  to  350  to  500  feet  and  was  in 
level  flight  when,  after  the  reduction  in  engine  noise,  it  pitched  slightly  nose-up,  entered  a  steep 
right  bank,  and  descended  nose-first  into  the  ocean. 

Safety  Board  investigators  determined  that  the  weight  and  center  of  gravity  of  the 
accident  airplane  were  within  the  original  planned  limits  for  the  Long-EZ  and  would  not  have 
affected  the  flight  or  stall  characteristics  of  the  airplane.  Based  on  the  airplane’s  fueling  history, 
the  technician’s  observations  of  the  fuel  levels  at  engine  start,  and  the  normal  fuel  consumption 
rates  of  the  airplane’s  Lycoming  O-320-E3D  engine,  the  airplane  would  have  had  about  3  1/2 
gallons  of  fuel  available  from  the  left  tank  and  about  6  1/2  gallons  of  fuel  available  from  the  right 
tank.  The  Safety  Board  found  that  witness  statements  were  consistent  with  the  checkout  pilot’s 
description  of  postflight  engine  shut-down  and  concluded  that  the  engine  lost  power  because  of 
fuel  starvation  or  exhaustion.3 

The  Long-EZ  was  designed  by  Rutan  Aircraft  Factory  and  amateur-built  from  the  Rutan 
plans  as  a  single-engine,  tandem  cockpit,  swept-wing,  canard-equipped4  airplane  with  laminar 
flow  airfoils.5  The  engine  is  mounted  aft  of  the  cabin,  and  both  cockpits  have  pitch  and  roll  side- 
stick  controls. 

The  all-composite6  airplane  has  a  canard  with  elevators  for  pitch  control.  The  swept 
wings  have  taper  and  twist  and  have  winglets  installed  at  the  tips.  According  to  technicians  from 
the  Experimental  Aircraft  Association  (EAA),  the  rudder  system  used  in  the  Long-EZ  is  very 

n 

sensitive  in  low-speed  flight.  According  to  the  former  Rutan  chief  engineer,  the  airplane  has  a 
substantial  glide  ratio  due  to  its  aerodynamically  clean  design  but  will  pitch  up  and  roll  right 
when  the  airspeed  is  slow  and  the  right  rudder  is  depressed.  When  the  airspeed  is  higher,  he 
stated  that  roll  rates  are  much  higher  and  that  it  is  possible  to  aileron-roll  the  airplane  from 
rudder  application  only  (ailerons  neutral). 

According  to  the  Long-EZ  owner’s  manual,  the  airplane  has  good  flight  characteristics  at 
minimum  speed.  The  manual  describes  “stalls”  as  maneuvers  that  result  in  increased  aft  stick 
force  or  mild  pitch  or  roll  oscillations.  Spin  attempts  result  in  a  spiral  that  reportedly  can  be 
recovered  by  neutralizing  rudder  and  pulling  out  normally.  The  Long-EZ  design  incorporates 
many  high  performance  features  but  would  not  be  considered  “high  performance”  by  Federal 


The  checkout  pilot  told  Safety  Board  investigators  that  when  the  engine  was  stopped  by  closing  the  mixture 
(shutting  off  the  fuel  supply)  at  the  end  of  a  flight,  loud  popping  normally  occurred. 

3 

For  more  information,  see  Brief  of  Accident  #LAX98FA008  (enclosed). 
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A  canard  is  a  lifting  airfoil  located  in  the  front  portion  of  an  airplane  that  eliminates  the  need  for  a  tail-mounted 
horizontal  stabilizer. 

5  Laminar  flow  airfoils  are  used  in  high  performance,  complex  aircraft  such  as  the  Beech  Starship.  The  airfoil 
construction  minimizes  drag  but  is  sensitive  to  boundary  layer  separation  (stall). 

6  The  Long-EZ  airplane  is  constructed  of  shaped  foam  and  fiberglass/epoxy  materials. 

7  The  rudder  system  in  the  Long-EZ  comprises  two  independent,  outward  acting  rudders  on  the  rear  of  the  winglets. 
Activation  in  low  speed  flight  is  very  easy;  however,  the  owners  manual  cautions  against  inadvertent  use  because  a 
substantial  yaw  will  result. 
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Aviation  Administration  (FAA)  definition8  because  the  airplane  has  no  flaps  or  controllable  pitch 
propeller.  Nonetheless,  its  laminar  flow  airfoils  have  greater  lift-to-drag  ratios  than  most  general 
aviation  airplanes.  Because  the  airplane  has  no  flaps,  its  landing  speeds  are  greater  than  many 
small  airplanes,  and  it  has  a  wings  level,  power  off  stall  speed  of  about  71  mph.9 

The  Long-EZ  airplane  has  two  26-gallon  fuel  tanks,  one  at  each  wing  root.  Fuel  quantity 
is  determined  by  viewing  the  rear  cockpit  sight  gauges.  N555JD  was  also  equipped  with  a  fuel 
totalizer.10  Fuel  is  selected  from  the  left  or  the  right  tank  by  turning  a  fuel  selector  handle. 
According  to  the  Rutan  design,  the  fuel  selector  handle  is  to  be  located  just  aft  of  the  nose  wheel 
position  window  between  the  pilot’s  legs  and  is  oriented  toward  the  right  to  select  the  right  tank, 
left  to  select  the  left  tank,  and  another  quarter  turn  to  the  left  to  select  the  “Off’  position.  A 
placard  associated  with  the  Rutan  design  clearly  identifies  the  fuel  selector  handle  positions. 

The  amateur  builder  of  N555JD  modified  the  fuel  system  design  by  locating  the  fuel 
selector  handle  on  the  left  side  of  the  bulkhead  that  forms  the  front  cockpit  seat  back.  It  was 
positioned  approximately  behind  the  front-seat  pilot’s  left  shoulder  (see  figure  1).  The  builder 
also  changed  the  orientation  of  the  handle  so  that  upward  selected  “Off,”  right  selected  the  left 
tank,  and  downward  selected  the  right  tank.  The  corresponding  3-position  fuel  selector  valve 
was  installed  inside  the  rear  cockpit  on  the  front  of  the  engine  firewall  just  behind  the  rear  seat 
and  was  connected  to  the  selector  handle  via  two  torque  tubes  and  a  universal  joint.  The  selector 
handle  was  about  4  feet  forward  of  the  fuel  selector  valve.  No  placard  or  marking  existed  (nor 
was  it  required)  on  the  fuel  selector  handle  base  that  would  have  indicated  to  the  pilot  its 
operating  position.  Further,  as  has  been  stated,  the  sight  gauges  were  not  marked  to  quantify  the 
amount  of  fuel  in  the  tanks. 


g 

The  FAA  defines  “high  performance”  as  an  airplane  that  has  an  engine  with  greater  than  200  horsepower  or  that 
has  retractable  landing  gear,  flaps,  and  a  controllable  pitch  propeller  (14  Code  of  Federal  Regulations  (CFR)  Part 
61.31  (e)). 

9 

The  maximum  stall  speed  allowed  for  aircraft  certificated  under  14  CFR  Part  23  is  61  knots  (70  mph). 

Although  the  accident  airplane  was  equipped  with  sight  gauges,  which  were  part  of  the  original  design,  it  also  had 
a  fuel  totalizer  installed  in  the  front  instrument  panel  that  required  pilot  entry  of  the  starting  fuel  amount.  Witness 
statements  provide  no  evidence  that  the  totalizer  was  used,  and  the  checkout  pilot  stated  he  was  not  familiar  with  it 
and  did  not  provide  any  instruction  on  its  use. 
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Figure  1 — Comparison  of  fuel  selector  handle  locations  in  Long-EZ 
N555JD  vs.  Original  design 

The  flight  control  side  sticks  in  both  cockpits  were  installed  in  armrests  on  the  right  side 
of  the  cockpits,  measured  about  6  inches  high,  and  were  similar  in  function  to  a  conventional 
control  stick.  During  the  postaccident  investigation,  simulation  by  Safety  Board  staff  showed 
that  the  front-seat  pilot  in  the  accident  airplane  would  have  had  to  loosen  his  shoulder  harness, 
completely  release  the  flight  control  stick,  turn  in  his  seat,  and  stretch  to  his  left  when  reaching 
over  the  left  shoulder  with  his  right  hand  to  change  the  position  of  the  fuel  selector  handle  on  the 
accident  Long-EZ  airplane.  The  Safety  Board  investigator,  in  every  simulation,  inadvertently 
applied  right  rudder  when  turning  his  body  and  reaching  for  the  fuel  selector  handle.  This 
finding  concerned  the  Safety  Board  because  the  design  change  that  moved  the  fuel  selector 
handle  introduced  a  safety  hazard  in  N555JD.  On  the  basis  of  the  accident  circumstances  and 
witness  accounts,  the  Board  concluded  that  the  accident  pilot  probably  inadvertently  applied  right 
rudder  while  manipulating  the  fuel  selector,  precipitating  the  loss  of  control  that  preceded  the 
accident. 

The  fuel  selector  valve  assembly  from  the  accident  airplane  was  found  in  an  intermediate 
position;  the  selector  valve  port  from  the  right  tank  fuel  supply  line  was  about  33  percent  open  to 
the  engine  feed  line  and  the  left  was  about  2  to  4  percent  open  to  the  engine  feed  line.  An  engine 
test  run  in  a  test  cell  showed  that  full  power  could  be  attained  (with  fuel  in  both  tanks)  with  the 
selector  valve  in  the  “as  found”  position.  However,  with  fuel  in  only  one  tank  and  the  other  fuel 
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line  open  to  the  atmosphere  to  simulate  an  empty  tank,  the  engine  lost  power  with  the  fuel 
selector  valve  in  the  “as  found”  position.  The  position  of  the  fuel  selector  handle  from  the 
accident  airplane  could  not  be  determined  because  of  damage  to  the  torque  tubes  between  the 
valve  and  the  selector  handle. 

Postaccident  examination  of  the  engine  revealed  no  mechanical  failures,  and  internal 
continuity  of  the  drive  train  components  was  established.  The  magneto11  was  tested  and 
produced  a  normal  spark.  The  fuel  lines  had  no  leaks  or  blockages.  The  evidence  indicated  that 
the  engine  was  capable  of  producing  normal  power  if  sufficient  fuel  was  supplied  to  it. 

The  Safety  Board  determined  that  the  probable  cause  of  the  accident  was  the  pilot’s 
diversion  of  attention  from  the  operation  of  the  airplane  and  his  inadvertent  application  of  right 
rudder  that  resulted  in  the  loss  of  airplane  control  while  attempting  to  manipulate  the  fuel 
selector  handle.  Also,  the  Board  determined  that  the  pilot’s  inadequate  preflight  planning  and 
preparation,  specifically  his  failure  to  refuel  the  airplane,  was  causal.  The  Board  determined  that 
the  builder’s  decision  to  locate  the  unmarked  fuel  selector  handle  in  a  hard-to-access  position, 
unmarked  fuel  quantity  sight  gauges,  inadequate  transition  training  by  the  pilot,  and  his  lack  of 
total  experience  in  the  type  of  airplane  were  factors  in  the  accident. 

N555JD  had  a  special  airworthiness  certificate  in  the  experimental  category12  that  was 
issued  on  May  5,  1987.  The  airplane  had  been  flown  about  850  hours  and  had  been  sold  two 
times  since  its  construction.  Because  N555JD  was  an  experimental,  amateur-built  airplane, 
specific  deviations  from  the  original  plans  did  not  require  FAA  approval  nor  was  a  placard 
required  to  identify  fuel  selector  valve  positions  or  to  indicate  that  there  had  been  a  change  in  the 
airplane’s  design.  However,  the  overall  design  is  evaluated  for  safety  and  airworthiness  by  the 
FAA  prior  to  issuing  the  experimental  airworthiness  certificate. 

The  Safety  Board  is  concerned  that  the  pilot  of  N555JD,  who  had  minimal13  pilot-in¬ 
command  experience  in  the  accident  airplane,  may  not  have  been  adequately  familiar  with  the 
operating  positions  of  the  unmarked  fuel  selector  handle.  This  is  of  special  concern  because  in 
its  modified  location  and  orientation,  the  fuel  selector  handle’s  operating  positions  would  have 
been  less  intuitively  obvious  than  if  it  had  been  installed  as  originally  designed.  Also, 
demonstrations  indicated  that  the  fuel  selector  handle  was  out  of  the  accident  pilot’s  view  and  in 
an  awkward  position  that  a  pilot  of  similar  height  as  the  accident  pilot  (5’  10”)  could  not  operate 
without  releasing  the  flight  control  stick.  An  interview  with  the  checkout  pilot  revealed  that  he 


This  engine  had  one  magneto  and  one  electronic  ignition  installed.  The  spark  plugs  showed  evidence  of  normal 
ignition,  and  the  magneto  functioned  normally  when  its  impulse-coupling  was  rotated  by  hand.  The  electronic 
ignition  was  not  tested. 

12  Title  14  CFR  21.191  “Experimental  Certificates,”  allows  experimental  airworthiness  certificates  to  be  issued  for, 
among  other  purposes,  the  operation  of  amateur-built  aircraft.  Amateur-built  aircraft  are  not  required  to  meet  the 

standardized  certification  requirements  contained  in  Part  23. 

13 

Safety  Board  investigators  determined  that  the  accident  pilot  had  about  70  minutes  of  pilot-in-command 
experience  in  this  model  airplane,  not  including  the  accident  flight.  The  pilot’s  flight  experience  will  be  discussed 
later  in  this  recommendation  letter. 
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had  avoided  this  problem  by  planning  his  flights  in  the  airplane  such  that  he  never  needed  to 
operate  the  fuel  selector  valve  handle  in  flight. 

Safety  Board  investigators  found  that  there  are  numerous  experimental  category  airplanes 
that  are  flown  without  placards  and  markings  on  cockpit  instruments  and  essential  system 
controls,  such  as  the  fuel  selector  handle.  Further,  essential  cockpit  controls,  including  fuel 
selectors  in  amateur-built  airplanes,  are  not  required  to  be  in  standardized  locations.  The  Board 
is  concerned  that  pilots  inexperienced  in  such  airplanes  may  find  it  difficult  to  operate  them 
without  type-specific  training  (type-specific  training  will  be  discussed  later  in  this 
recommendation  letter).14 

FAA  Order  8130.2C,  “Airworthiness  Certification  of  Aircraft  and  Related  Products,” 
provides  guidance  to  FAA  aviation  safety  inspectors  regarding  the  issuance  of  special 
airworthiness  certificates  and  operating  limitations  for  experimental  aircraft.  Paragraph  88(b)  of 
this  order  describes  inspections  necessary  to  obtain  special  airworthiness  certificates.  It  indicates 
that  all  instruments  should  be  marked  according  to  the  approved  flight  manual.  Advisory 
Circular  (AC)  20-27D  “Certification  and  Operation  of  Amateur-Built  Aircraft,”  provides 
guidance  to  pilots  on  building,  certifying,  and  operating  amateur-built  aircraft  and  describes  the 
FAA’s  role  in  the  certification  process.  Paragraph  12  of  AC  20-27D  states  that  the  applicant 
should  expect  the  FAA  inspector  or  the  designated  airworthiness  representative  (DAR)15  to 
verify  that  all  required  markings  are  properly  applied.  The  FAA  order  and  the  AC,  however,  do 
not  explicitly  require  the  inspection  of  placards  or  markings  in  the  cockpit  before  issuing  special 
airworthiness  certificates.  They  also  do  not  provide  adequate  guidance  or  evaluation  concerning 
the  inspection  of  the  placement  or  operation  of  essential  controls.  Because  accident  data  from  a 
Safety  Board  study  suggest  that  the  ergonomics  of  cockpit  control  placement  can  be  critical  in  the 
safe  operation  of  airplanes,16  the  Board  is  concerned  that  a  lack  of  requirements  for  standardized 
placards,  markings,  or  appropriate  placement  of  essential  system  controls  could  jeopardize  flight 
safety  in  experimental,  amateur-built  airplanes.  Therefore,  the  Safety  Board  believes  that  the 
FAA  should  amend  FAA  Order  8130.2C  to  specify  that,  before  the  issuance  of  special 
airworthiness  certificates,  experimental,  amateur-built  airplanes  should  be  inspected  for  needed 
placards  and  markings  on  cockpit  instruments  and  for  the  appropriate  placement  and  operation  of 


14  Safety  Board  staff  found  that  the  Glasair  training  syllabus  directed  the  pilot  to  answer  multiple  questions 
concerning,  among  other  subjects,  fuel  system  descriptions,  operations,  and  emergency  procedures. 

15  DARs  are  private  persons  designated  by  the  FAA  to  act  in  its  behalf  in  the  inspection  of  aircraft  and  to  issue 
airworthiness  certificates. 

16  A  1974  NTSB  special  study,  U.S.  General  Aviation  Accidents  Involving  Fuel  Starvation  (AAS-74-01)  analyzed 
fuel  starvation  aircraft  accidents  from  1970  through  1972.  Among  the  recommendations  in  the  report,  which  were 
intended  to  reduce  the  number  of  fuel  starvation  accidents,  the  Safety  Board  asked  the  FAA  to  amend  14  CFR  Part 
23  to  include  specifications  for  standardizing  fuel  selector  valve  designs,  displays,  and  modes  of  operation  (A-74- 
39).  This  recommendation  was  classified  “Closed — Acceptable  Action”  after  the  FAA  changed  Part  23.  Currently, 
14  CFR  Part  23.777  addresses  the  physical  placement  of  controls  and  states  that  "each  fuel  feed  selector  control 
must...be  located  and  arranged  so  that  the  pilot  can  see  and  reach  it  without  moving  any  seat  or  primary  flight  control 
when  his  seat  is  at  any  position  in  which  it  can  be  placed."  The  mapping  of  fuel  selector  control  positions  in 
accordance  with  natural  expectations  is  addressed  in  14  CFR  Part  23.779,  which  requires  that  fuel  selector  control 
movement  be  consistent  with  tank  selection  (i.e.,  left  for  left  tanks;  right  for  right  tanks). 
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essential  system  controls  to  ensure  that  they  provide  clear  marking,  easy  access,  and  ease  of 
operation. 

The  Safety  Board  notes  that  the  requirement  for  an  annual  inspection  (referred  to  as  a 
condition  inspection)17  of  experimental,  amateur-built  airplanes  is  contained  in  a  limitations 
letter  attached  to  the  special  certificate  of  airworthiness.18  Paragraphs  141  and  142  of  Order 
8130.2C  generally  describe  the  issuance  of  experimental  operating  limitations,19  which  always 
include  the  inspection  requirements.  The  operating  limitations  state  that  the  condition  inspection 
shall  be  recorded  in  the  aircraft  maintenance  records  in  accordance  with  the  scope  and  detail  of 
14  CFR  Part  43,  Appendix  D  or  other  FAA-approved  programs  and  that  the  condition  inspection 
is  equivalent  to  an  annual  inspection. 

The  operations  limitations  may  require  the  use  of  placards  and  markings  to  ensure  the 
safe  operation  of  the  aircraft.  The  Safety  Board  is  not  aware  of  any  recurrent  requirement  to 
inspect  placards  and  markings  in  the  cockpit  and  on  essential  system  controls  to  ensure  that  they 
display  appropriate  and  accurate  information. 

The  Safety  Board  is  concerned  about  the  lack  of  requirements  to  periodically  inspect  the 
placards,  markings,  and  essential  controls  in  experimental,  amateur-built  aircraft.  Periodic 
inspection  of  these  items  is  necessary  to  ensure  that  they  consistently  display  appropriate  and 
accurate  information  to  the  pilot  for  flight  safety.  Therefore,  the  Safety  Board  believes  that  the 
FAA  should  amend  FA  A  Order  8130.2C  to  specify  that  inspection  limitations  be  issued  with 
special  airworthiness  certificates  for  amateur-built  airplanes  requiring  that  the  annual  condition 
inspection  include  an  inspection  for  needed  placards  and  markings  on  cockpit  instruments  and 
the  appropriate  operation  of  essential  controls  to  ensure  that  they  provide  clear  marking,  easy 
access,  and  ease  of  operation. 

Another  concern  of  the  Safety  Board  was  the  limited  amount  of  transition  training 
received  by  the  accident  pilot  in  the  accident  airplane.  A  review  of  the  pilot’s  FAA  airman  and 
medical  records  indicated  that  he  held  a  private  pilot  certificate  with  airplane  ratings  for  single 
and  multiengine  land,  single-engine  sea,  instrument  airplane,  glider,  and  a  Lear  Jet  type  rating. 
The  pilot’s  logbook  was  not  recovered  after  the  accident;  however,  his  total  flight  time  reported 
on  his  last  physical  was  2,750  hours,  including  15  hours  in  the  preceding  6  months.  The  Safety 
Board’s  investigation  revealed  that  the  pilot  purchased  the  accident  airplane  on  September  27, 
1997,  and  that  his  pilot-in-command  experience  in  the  airplane  was  limited  to  a  1/2-hour  ground 
and  flight  checkout  on  the  day  before  the  accident  and  a  1-hour  solo  flight.  According  to  an  air 
traffic  control  communication  tape,  the  duration  of  the  checkout  flight  was  only  10  minutes,  and 
the  pilot  departed  about  20  minutes  later  for  a  1-hour  solo  flight  to  his  home  airport.  The  Safety 
Board  learned  that  the  pilot  had  been  on  three  previous  demonstration  flights  in  Long-EZ 
airplanes  (during  all  of  which  he  occupied  the  rear  seat)  but  could  not  determine  how  much,  if 


17 

Condition  inspection  is  defined  in  the  Airworthiness  Inspector’s  Handbook,  FAA  Order  8300.10,  Chapter  25. 

18 

The  limitations  letter  lists  requirements  for  continued  airworthiness. 

19  The  operating  limitations  are  designed  for  each  aircraft.  The  FAA  inspector  may  impose  any  operational 
limitations  deemed  necessary  in  the  interest  of  safety.  . 
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any,  pilot  training  he  received  during  these  flights.20  The  Safety  Board  found  no  evidence  of  the 
pilot  having  any  other  flight  experience  in  Long-EZ  airplanes. 

On  the  basis  of  his  limited  flight  experience  in  this  type  of  airplane,  the  Safety  Board 
concludes  that  the  pilot  likely  did  not  have  the  necessary  knowledge  and  skills  to  efficiently 
operate  it  during  the  emergency  circumstances  of  the  accident  flight.  Had  the  pilot  been  more 
skilled  in  the  operation  of  the  flight  controls  and  knowledgeable  of  the  unusual  fuel  selector,  the 
accident  might  have  been  avoided  or  the  severity  of  the  accident  could  have  been  reduced.21 

The  Safety  Board  is  aware  that  some  advanced,22  experimental,  amateur-built  airplane 
training  organizations  have  published  training  syllabi.  The  Safety  Board  also  notes  that  insurers23 
of  amateur-built  airplanes,  similar  to  or  more  advanced  than  the  Long-EZ,  have  sometimes 
required  a  training  syllabus  and  detailed  aircraft  inspection  as  conditions  for  providing  insurance 
coverage  for  the  pilot/owner.  The  Safety  Board  has  found  that  the  accident  rates  for  high 
performance,  complex,  and  unusual  aircraft  may  be  substantially  reduced  by  requiring 
pilot/owner-operators  to  undergo  type-specific  ground  and  flight  training.  For  example,  it  was 
found  that  when  formal  flight  and  ground  training  was  required  for  pilots  of  Piper  PA-46  Malibu 
airplanes,  the  fatal  accident  rate  in  that  airplane  model  was  reduced.24  Further,  the  Aviation 
Insurance  Association  (AIA)  has  reported  that  using  and  closely  adhering  to  a  specified  training 
syllabus  has  considerably  reduced  the  accident  rate  in  the  Glasair  and  Lancair  experimental, 
amateur-built  airplanes.25  Additionally,  the  Safety  Board  found  accident  rates  of  Robinson  R22 
helicopters  were  substantially  reduced  when,  in  response  to  the  Safety  Board’s  recommendations, 
the  FAA  issued  Special  Federal  Aviation  Regulation  (SFAR)  73  on  February  23,  1995, 


20 

According  to  the  Rutan  engineer  who  gave  the  first  demonstration  flight,  the  pilot  said  he  had  no  previous  flights 
in  Long-EZ  airplanes.  Only  one  demonstration  flight  was  in  N555JD. 

The  in-flight  manipulation  of  the  fuel  selector,  the  location  and  accuracy  of  the  fuel  quantity  sight  gauges,  and 

using  the  installed  fuel  totalizer  probably  would  have  been  included  in  formalized  transition  training. 

22 

“Advanced”  experimental  airplanes  are  typically  faster,  aerodynamically  cleaner,  and  are  more  complex  than  most 
amateur-built  aircraft.  The  Safety  Board  staff  found  three  companies  that  sell  kits  for  experimental,  amateur-built 
airplanes  and  that  provide  formal,  type-specific  ground  and  flight  training  to  the  owner/pilots  of  these  airplanes.  The 
Glasair  training  plan  provides  for  approved  certificated  flight  instructors  located  in  different  areas  of  the  country  that 
will  conduct  the  formal  course  of  instruction  to  the  pilot.  The  Lancair  plan  provides  ground  instruction  at  its  factory 
and  provides  a  factory  test  pilot  to  fly  at  the  builder's  location  in  the  builder’s  airplane  through  the  first  10  hours  of 
the  flight  test  program.  The  Velocity  plan  has  east  and  west  coast  centers  that  provide  formal  ground  and  flight 
instruction.  Safety  Board  staff  found  that  each  company,  in  conjunction  with  insurers,  mandates  its  specific  course 
of  training.  Each  of  these  formal  programs  provides  certification  to  the  insurers  of  the  experimental,  amateur-built 

airplane  when  pilots  complete  the  prescribed  training. 

23 

According  to  the  AIA,  accident  rates  for  the  Glasair  and  Lancair  airplanes  have  dramatically  dropped  because  of 

insurers  requiring  pilots’  use  of  type-specific  training  syllabi. 

24 

A  spokesman  for  AVEMCO  (a  major  aircraft  insurer)  reported  to  the  Safety  Board  that,  as  a  condition  of 
insurance,  his  company  requires  that  all  PA-46  pilots  (and  pilots  of  other  pressurized  airplanes)  attend  formal 
training  that  includes  completion  of  a  type-specific  training  syllabus.  These  programs  reportedly  reduced  the 
accident  rates  of  these  airplanes.  The  Safety  Board’s  accident  data  show  no  PA-46  fatal  accidents  during  1992  and 
1997,  1  in  1993,  2  in  1998,  and  3  in  1994,  1995,  and  1996,  respectively.  None  of  the  accidents’  probable  causes  is 

attributed  to  inadequate  transition  training. 

25  ,  # 

The  AIA  has  reported  that  by  requiring  type-specific  transition  training  in  conjunction  with  the  airplane 
manufacturer,  the  accident  rates  for  those  aircraft  were  significantly  lowered. 
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promulgating  special  training,  proficiency,  and  operational  rules  for  pilots  operating  these 
helicopters.26  The  SFAR  required  specific  training  in  this  highly  responsive  helicopter  before  a 
pilot  could  operate  it  as  the  pilot-in-command. 

A  1998  query  showed  that  the  FAA’s  aircraft  database  contains  about  20,244 
experimental,  amateur-built  aircraft,  including  1,200  Long-EZ  airplanes.27  According  to  the 
EAA,  about  8,000  additional  aircraft  were  in  the  process  of  being  built  by  amateur  builders  in 
*  1997,  and  in  the  next  few  years,  a  significant  number  of  amateur-built  airplanes  will  be  sold  to 

non-builders.  As  previously  mentioned,  experimental,  amateur-built  aircraft  are  not  required  to 
«  be  certificated  to  14  CFR  Part  23  certification  standards  and,  therefore,  may  well  have  control 

locations,  functions,  and  markings  that  do  not  conform  to  the  original  design  plans.  Because  of 
these  and  other  differences  (such  as  performance  and  handling  characteristics)  between 
experimental,  amateur-built  aircraft  and  Part  23  aircraft,  quality  transition  training28  of  pilots 
flying  them  is  critical  to  their  safe  operation. 

The  Safety  Board  is  aware  of  the  EAA’s  Flight  Advisor  Program,  which  is  designed  to 
help  amateur  airplane  builders  safely  perform  their  first  flight.  In  this  program,  advisors  with 
substantial  flying/building  experience  offer  free  advice,  videos,  and  written  guidance  to  help 
make  builders’  first  test  flight  a  safe  one.  The  advisors  do  not  provide  flight  training  but  offer 
training  suggestions  and  options  for  the  pilot  to  consider.  This  program,  which  the  EAA  claims 
has  resulted  in  reduced  first-flight  accident  rates,29  is  generally  known  among  EAA  members  but 
not  among  the  general  pilot  population. 

Such  programs  can  provide  an  added  margin  of  safety  for  pilots  inexperienced  in  the 
operation  of  unusual  or  unique,  non-Part  23-certificated  aircraft.  Unfortunately,  no  FAA  ACs, 
pamphlets,  or  programs  exist  that  require  or  encourage  pilots  who  did  not  build  their 
experimental  category  airplanes  to  receive  type-specific  transition  flight  training.  FAA 
publications  and  programs  also  lack  emphasis  on  the  benefits  of  formalized  syllabi  for  such 
transition  training.  The  Safety  Board  concludes  that  an  expanded  flight  advisor  program  could 
substantially  reduce  the  experimental,  amateur-built  airplane  accident  rate.  Therefore,  the  Safety 
Board  believes  that  the  AIA  should  establish,  in  conjunction  with  the  FAA  and  the  EAA,  a 
cooperative  program  that  strongly  encourages  pilots  transitioning  to  unusual  or  unfamiliar 
amateur-built,  experimental  category  airplanes  to  undergo  formalized,  type-specific  transition 
training  similar  to  that  provided  to  pilots  of  some  advanced,  experimental,  amateur-built 
airplanes. 


For  more  information,  see  NTSB  Special  Investigation  Report,  NTSB/SIR-96/03,  Robinson  Helicopter  Company 

R22  Loss  of  Main  Rotor  Control  Accidents,  dated  April  2,  1996. 

27 

According  to  the  EAA,  4,500  Long-EZ  plans  were  sold.  The  EAA  estimates  that  about  95,000  plans  or  kits  have 

been  sold  to  prospective  amateur  builders  of  all  aircraft  types  in  the  past  10  years. 

28 

The  Safety  Board  considers  quality  transition  training  to  be  type-specific,  formal  transition  training  that  adheres  to 

a  training  syllabus. 

29 

The  EAA  has  reported  significant  accident  rate  reductions  since  the  Flight  Advisor  program  was  started  in  1995. 
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Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Aviation 
Insurance  Association: 

Establish,  in  conjunction  with  the  Federal  Aviation  Administration  and  the 
Experimental  Aircraft  Association,  a  cooperative  program  that  strongly 
encourages  pilots  transitioning  to  unusual  or  unfamiliar  amateur-built, 
experimental  category  airplanes  to  undergo  formalized,  type-specific  transition 
training  similar  to  that  provided  to  pilots  of  some  advanced,  experimental, 
amateur-built  airplanes.  (A-99-8) 

Also  as  a  result  of  its  investigation,  the  Safety  Board  issued  Safety  Recommendations 
A-99-5  through  -7  to  the  FAA  and  A-99-9  to  the  EAA. 

The  National  Transportation  Safety  Board  is  an  independent  Federal  agency  with  the 
statutory  responsibility  “...to  promote  transportation  safety  by  conducting  independent  accident 
investigations  and  by  formulating  safety  improvement  recommendations”  (Public  Law  93-633). 
The  Safety  Board  is  vitally  interested  in  any  actions  taken  as  a  result  of  its  safety 
recommendations  and  would  appreciate  a  response  from  you  regarding  action  taken  or 
contemplated  with  respect  to  the  recommendation  in  this  letter.  Please  refer  to  Safety 
Recommendation  A-99-8  in  your  reply. 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMIDT, 
GOGLIA,  and  BLACK  concurred  in  this  recommendation. 
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Brief  of  Accident  (Continued) 
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National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  February  3,  1999 
In  reply  refer  to:  A-99-9 


Mr.  Tom  Poberezny 
President 

Experimental  Aircraft  Association 
Post  Office  Box  3086 
Oshkosh,  Wisconsin  54093-3086 


On  October  12,  1997,  about  1728  Pacific  daylight  time,  an  experimental  category, 
amateur-built  Adrian  Davis1  Long-EZ  airplane,  N555JD,  crashed  into  the  Pacific  Ocean  near 
Pacific  Grove,  California.  Air  traffic  control  communications  indicated  that  the  airplane  had 
departed  from  the  Monterey  Peninsula  Airport’s  runway  28L  about  1712,  and  the  pilot  performed 
three  touch-and-go  landings  and  departed  to  the  west  moments  before  the  accident.  Witnesses 
reported  that  they  heard  engine  popping  and  a  reduction  in  engine  noise  before  the  accident.  The 
pilot  made  no  distress  calls.  The  pilot  was  killed,  and  the  airplane  was  destroyed. 

An  airport  maintenance  technician  helped  the  pilot  push  the  airplane  out  of  the  hangar 
before  the  accident  flight  and  was  present  during  the  preflight  check.  The  technician  said  he  told 
the  pilot  that  less  than  a  quarter  tank  of  fuel  was  available  in  the  left  tank  and  less  than  half  a  tank 
of  fuel  was  available  in  the  right  tank.  The  technician  estimated  the  fuel  quantity  based  on  the 
assumption  that  the  presentations  on  the  unmarked  sight  gauges  were  linear.  However,  Long-EZ 
fuel  tank  sight  gauges  are  not  linear,  and  examination  of  other  Long-EZ  sight  gauges  revealed 
that  the  actual  fuel  on-board  the  airplane  would  have  been  much  lower  than  the  technician’s 
estimate.  The  fuel  tank  sight  gauges  were  not  visible  from  the  front  cockpit.  The  technician 
loaned  the  pilot  a  shop  inspection  mirror  so  it  would  be  possible  for  the  pilot  to  see  the  fuel  tank 
sight  gauges  in  flight.  The  pilot  told  the  technician  that  he  did  not  wish  to  refuel  the  airplane. 

The  technician  said  he  heard  the  engine  start  and  run  for  a  short  time  and  quit.  Watching 
from  the  hangar,  he  saw  the  pilot  turn  in  the  front  cockpit  toward  the  fuel  selector  handle  behind 
his  left  shoulder.  Shortly  afterward,  the  technician  heard  the  engine  restarted.  The  pilot  signaled 
an  “okay”  to  the  technician  and  taxied  toward  the  runway.  After  the  airplane  departed  the  traffic 


The  Federal  Aviation  Administration  (FAA)  issues  experimental  airworthiness  certificates  for  amateur-built  aircraft 
with  the  original  builder’s  name  as  the  manufacturer.  Any  subsequent  owner  may  change  the  registration  number  but 
not  the  Certificate  of  Airworthiness.  Hence,  the  builder’s  name  appears  on  the  Certificate  of  Airworthiness. 
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pattern  to  the  west,  witnesses  reported  that  the  airplane  climbed  to  350  to  500  feet  and  was  in 
level  flight  when,  after  the  reduction  in  engine  noise,  it  pitched  slightly  nose-up,  entered  a  steep 
right  bank,  and  descended  nose-first  into  the  ocean. 

Safety  Board  investigators  determined  that  the  weight  and  center  of  gravity  of  the 
accident  airplane  were  within  the  original  planned  limits  for  the  Long-EZ  and  would  not  have 
affected  the  flight  or  stall  characteristics  of  the  airplane.  Based  on  the  airplane’s  fueling  history, 
the  technician’s  observations  of  the  fuel  levels  at  engine  start,  and  the  normal  fuel  consumption 
rates  of  the  airplane’s  Lycoming  O-320-E3D  engine,  the  airplane  would  have  had  about  3  1/2 
gallons  of  fuel  available  from  the  left  tank  and  about  6  1/2  gallons  of  fuel  available  from  the  right 
tank.  The  Safety  Board  found  that  witness  statements  were  consistent  with  the  checkout  pilot’s 
description  of  postflight  engine  shut-down2  and  concluded  that  the  engine  lost  power  because  of 
fuel  starvation  or  exhaustion.3 

The  Long-EZ  was  designed  by  Rutan  Aircraft  Factory  and  amateur-built  from  the  Rutan 
plans  as  a  single-engine,  tandem  cockpit,  swept-wing,  canard-equipped4  airplane  with  laminar 
flow  airfoils.5  The  engine  is  mounted  aft  of  the  cabin,  and  both  cockpits  have  pitch  and  roll  side- 
stick  controls. 

The  all-composite6  airplane  has  a  canard  with  elevators  for  pitch  control.  The  swept 
wings  have  taper  and  twist  and  have  winglets  installed  at  the  tips.  According  to  technicians  from 
the  Experimental  Aircraft  Association  (EAA),  the  rudder  system  used  in  the  Long-EZ  is  very 
sensitive7  in  low-speed  flight.  According  to  the  former  Rutan  chief  engineer,  the  airplane  has  a 
substantial  glide  ratio  due  to  its  aerodynamically  clean  design  but  will  pitch  up  and  roll  right 
when  the  airspeed  is  slow  and  the  right  rudder  is  depressed.  When  the  airspeed  is  higher,  he 
stated  that  roll  rates  are  much  higher  and  that  it  is  possible  to  aileron-roll  the  airplane  from 
rudder  application  only  (ailerons  neutral). 

According  to  the  Long-EZ  owner’s  manual,  the  airplane  has  good  flight  characteristics  at 
minimum  speed.  The  manual  describes  “stalls”  as  maneuvers  that  result  in  increased  aft  stick 
force  or  mild  pitch  or  roll  oscillations.  Spin  attempts  result  in  a  spiral  that  reportedly  can  be 
recovered  by  neutralizing  rudder  and  pulling  out  normally.  The  Long-EZ  design  incorporates 
many  high  performance  features  but  would  not  be  considered  “high  performance”  by  Federal 


/-*■ 


2  The  checkout  pilot  told  Safety  Board  investigators  that  when  the  engine  was  stopped  by  closing  the  mixture 
(shutting  off  the  fuel  supply)  at  the  end  of  a  flight,  loud  popping  normally  occurred. 

3  For  more  information,  see  Brief  of  Accident  #LAX98FA008  (enclosed). 

4  A  canard  is  a  lifting  airfoil  located  in  the  front  portion  of  an  airplane  that  eliminates  the  need  for  a  tail-mounted 
horizontal  stabilizer. 

5  Laminar  flow  airfoils  are  used  in  high  performance,  complex  aircraft  such  as  the  Beech  Starship.  The  airfoil 
construction  minimizes  drag  but  is  sensitive  to  boundary  layer  separation  (stall). 

6  The  Long-EZ  airplane  is  constructed  of  shaped  foam  and  fiberglass/epoxy  materials. 

7  The  rudder  system  in  the  Long-EZ  comprises  two  independent,  outward  acting  rudders  on  the  rear  of  the  winglets. 
Activation  in  low  speed  flight  is  very  easy;  however,  the  owners  manual  cautions  against  inadvertent  use  because  a 
substantial  yaw  will  result. 
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Aviation  Administration  (FAA)  definition8  because  the  airplane  has  no  flaps  or  controllable  pitch 
propeller.  Nonetheless,  its  laminar  flow  airfoils  have  greater  lift-to-drag  ratios  than  most  general 
aviation  airplanes.  Because  the  airplane  has  no  flaps,  its  landing  speeds  are  greater  than  many 
small  airplanes,  and  it  has  a  wings  level,  power  off  stall  speed  of  about  71  mph.9 

The  Long-EZ  airplane  has  two  26-gallon  fuel  tanks,  one  at  each  wing  root.  Fuel  quantity 
is  determined  by  viewing  the  rear  cockpit  sight  gauges.  N555JD  was  also  equipped  with  a  fuel 
totalizer.10  Fuel  is  selected  from  the  left  or  the  right  tank  by  turning  a  fuel  selector  handle. 
According  to  the  Rutan  design,  the  fuel  selector  handle  is  to  be  located  just  aft  of  the  nose  wheel 
position  window  between  the  pilot’s  legs  and  is  oriented  toward  the  right  to  select  the  right  tank, 
left  to  select  the  left  tank,  and  another  quarter  turn  to  the  left  to  select  the  “Off’  position.  A 
placard  associated  with  the  Rutan  design  clearly  identifies  the  fuel  selector  handle  positions. 

The  amateur  builder  of  N555JD  modified  the  fuel  system  design  by  locating  the  fuel 
selector  handle  on  the  left  side  of  the  bulkhead  that  forms  the  front  cockpit  seat  back.  It  was 
positioned  approximately  behind  the  front-seat  pilot’s  left  shoulder  (see  figure  1).  The  builder 
also  changed  the  orientation  of  the  handle  so  that  upward  selected  “Off,”  right  selected  the  left 
tank,  and  downward  selected  the  right  tank.  The  corresponding  3-position  fuel  selector  valve 
was  installed  inside  the  rear  cockpit  on  the  front  of  the  engine  firewall  just  behind  the  rear  seat 
and  was  connected  to  the  selector  handle  via  two  torque  tubes  and  a  universal  joint.  The  selector 
handle  was  about  4  feet  forward  of  the  fuel  selector  valve.  No  placard  or  marking  existed  (nor 
was  it  required)  on  the  fuel  selector  handle  base  that  would  have  indicated  to  the  pilot  its 
operating  position.  Further,  as  has  been  stated,  the  sight  gauges  were  not  marked  to  quantify  the 
amount  of  fuel  in  the  tanks. 


8 

The  FAA  defines  “high  performance”  as  an  airplane  that  has  an  engine  with  greater  than  200  horsepower  or  that 
has  retractable  landing  gear,  flaps,  and  a  controllable  pitch  propeller  (14  Code  of  Federal  Regulations  (CFR)  Part 
61.31  (e)). 

9 

The  maximum  stall  speed  allowed  for  aircraft  certificated  under  14  CFR  Part  23  is  61  knots  (70  mph). 

Although  the  accident  airplane  was  equipped  with  sight  gauges,  which  were  part  of  the  original  design,  it  also  had 
a  fuel  totalizer  installed  in  the  front  instrument  panel  that  required  pilot  entry  of  the  starting  fuel  amount.  Witness 
statements  provide  no  evidence  that  the  totalizer  was  used,  and  the  checkout  pilot  stated  he  was  not  familiar  with  it 
and  did  not  provide  any  instruction  on  its  use. 
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Figure  1 — Comparison  of  fuel  selector  handle  locations  in  Long-EZ 
N555JD  vs.  Original  design 

The  flight  control  side  sticks  in  both  cockpits  were  installed  in  armrests  on  the  right  side 
of  the  cockpits,  measured  about  6  inches  high,  and  were  similar  in  function  to  a  conventional 
control  stick.  During  the  postaccident  investigation,  simulation  by  Safety  Board  staff  showed 
that  the  front-seat  pilot  in  the  accident  airplane  would  have  had  to  loosen  his  shoulder  harness, 
completely  release  the  flight  control  stick,  turn  in  his  seat,  and  stretch  to  his  left  when  reaching 
over  the  left  shoulder  with  his  right  hand  to  change  the  position  of  the  fuel  selector  handle  on  the 
accident  Long-EZ  airplane.  The  Safety  Board  investigator,  in  every  simulation,  inadvertently 
applied  right  rudder  when  turning  his  body  and  reaching  for  the  fuel  selector  handle.  This 
finding  concerned  the  Safety  Board  because  the  design  change  that  moved  the  fuel  selector 
handle  introduced  a  safety  hazard  in  N555JD.  On  the  basis  of  the  accident  circumstances  and 
witness  accounts,  the  Board  concluded  that  the  accident  pilot  probably  inadvertently  applied  right 
rudder  while  manipulating  the  fuel  selector,  precipitating  the  loss  of  control  that  preceded  the 
accident. 

The  fuel  selector  valve  assembly  from  the  accident  airplane  was  found  in  an  intermediate 
position;  the  selector  valve  port  from  the  right  tank  fuel  supply  line  was  about  33  percent  open  to 
the  engine  feed  line  and  the  left  was  about  2  to  4  percent  open  to  the  engine  feed  line.  An  engine 
test  run  in  a  test  cell  showed  that  full  power  could  be  attained  (with  fuel  in  both  tanks)  with  the 
selector  valve  in  the  “as  found”  position.  However,  with  fuel  in  only  one  tank  and  the  other  fuel 
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line  open  to  the  atmosphere  to  simulate  an  empty  tank,  the  engine  lost  power  with  the  fuel 
selector  valve  in  the  “as  found”  position.  The  position  of  the  fuel  selector  handle  from  the 
accident  airplane  could  not  be  determined  because  of  damage  to  the  torque  tubes  between  the 
valve  and  the  selector  handle. 

Postaccident  examination  of  the  engine  revealed  no  mechanical  failures,  and  internal 
continuity  of  the  drive  train  components  was  established.  The  magneto11  was  tested  and 
produced  a  normal  spark.  The  fuel  lines  had  no  leaks  or  blockages.  The  evidence  indicated  that 
the  engine  was  capable  of  producing  normal  power  if  sufficient  fuel  was  supplied  to  it. 

The  Safety  Board  determined  that  the  probable  cause  of  the  accident  was  the  pilot’s 
diversion  of  attention  from  the  operation  of  the  airplane  and  his  inadvertent  application  of  right 
rudder  that  resulted  in  the  loss  of  airplane  control  while  attempting  to  manipulate  the  fuel 
selector  handle.  Also,  the  Board  determined  that  the  pilot’s  inadequate  preflight  planning  and 
preparation,  specifically  his  failure  to  refuel  the  airplane,  was  causal.  The  Board  determined  that 
the  builder’s  decision  to  locate  the  unmarked  fuel  selector  handle  in  a  hard-to-access  position, 
unmarked  fuel  quantity  sight  gauges,  inadequate  transition  training  by  the  pilot,  and  his  lack  of 
total  experience  in  the  type  of  airplane  were  factors  in  the  accident. 

N555JD  had  a  special  airworthiness  certificate  in  the  experimental  category12  that  was 
issued  on  May  5,  1987.  The  airplane  had  been  flown  about  850  hours  and  had  been  sold  two 
times  since  its  construction.  Because  N555JD  was  an  experimental,  amateur-built  airplane, 
specific  deviations  from  the  original  plans  did  not  require  FAA  approval  nor  was  a  placard 
required  to  identify  fuel  selector  valve  positions  or  to  indicate  that  there  had  been  a  change  in  the 
airplane’s  design.  However,  the  overall  design  is  evaluated  for  safety  and  airworthiness  by  the 
FAA  prior  to  issuing  the  experimental  airworthiness  certificate. 

The  Safety  Board  is  concerned  that  the  pilot  of  N555JD,  who  had  minimal13  pilot-in¬ 
command  experience  in  the  accident  airplane,  may  not  have  been  adequately  familiar  with  the 
operating  positions  of  the  unmarked  fuel  selector  handle.  This  is  of  special  concern  because  in 
its  modified  location  and  orientation,  the  fuel  selector  handle’s  operating  positions  would  have 
been  less  intuitively  obvious  than  if  it  had  been  installed  as  originally  designed.  Also, 
demonstrations  indicated  that  the  fuel  selector  handle  was  out  of  the  accident  pilot’s  view  and  in 
an  awkward  position  that  a  pilot  of  similar  height  as  the  accident  pilot  (5’  10”)  could  not  operate 
without  releasing  the  flight  control  stick.  An  interview  with  the  checkout  pilot  revealed  that  he 


This  engine  had  one  magneto  and  one  electronic  ignition  installed.  The  spark  plugs  showed  evidence  of  normal 
ignition,  and  the  magneto  functioned  normally  when  its  impulse-coupling  was  rotated  by  hand.  The  electronic 
ignition  was  not  tested. 

12  Title  14  CFR  21.191  “Experimental  Certificates,”  allows  experimental  airworthiness  certificates  to  be  issued  for, 
among  other  purposes,  the  operation  of  amateur-built  aircraft.  Amateur-built  aircraft  are  not  required  to  meet  the 
standardized  certification  requirements  contained  in  Part  23. 

Safety  Board  investigators  determined  that  the  accident  pilot  had  about  70  minutes  of  pilot-in-command 
experience  in  this  model  airplane,  not  including  the  accident  flight.  The  pilot’s  flight  experience  will  be  discussed 
later  in  this  recommendation  letter. 


6 


had  avoided  this  problem  by  planning  his  flights  in  the  airplane  such  that  he  never  needed  to 
operate  the  fuel  selector  valve  handle  in  flight. 

Safety  Board  investigators  found  that  there  are  numerous  experimental  category  airplanes 
that  are  flown  without  placards  and  markings  on  cockpit  instruments  and  essential  system 
controls,  such  as  the  fuel  selector  handle.  Further,  essential  cockpit  controls,  including  fuel 
selectors  in  amateur-built  airplanes,  are  not  required  to  be  in  standardized  locations.  The  Board 
is  concerned  that  pilots  inexperienced  in  such  airplanes  may  find  it  difficult  to  operate  them 
without  type-specific  training  (type-specific  training  will  be  discussed  later  in  this 
recommendation  letter).14 

FAA  Order  8130.2C,  “Airworthiness  Certification  of  Aircraft  and  Related  Products,” 
provides  guidance  to  FAA  aviation  safety  inspectors  regarding  the  issuance  of  special 
airworthiness  certificates  and  operating  limitations  for  experimental  aircraft.  Paragraph  88(b)  of 
this  order  describes  inspections  necessary  to  obtain  special  airworthiness  certificates.  It  indicates 
that  all  instruments  should  be  marked  according  to  the  approved  flight  manual.  Advisory 
Circular  (AC)  20-27D  “Certification  and  Operation  of  Amateur-Built  Aircraft,”  provides 
guidance  to  pilots  on  building,  certifying,  and  operating  amateur-built  aircraft  and  describes  the 
FAA’s  role  in  the  certification  process.  Paragraph  12  of  AC  20-27D  states  that  the  applicant 
should  expect  the  FAA  inspector  or  the  designated  airworthiness  representative  (DAR)  to 
verify  that  all  required  markings  are  properly  applied.  The  FAA  order  and  the  AC,  however,  do 
not  explicitly  require  the  inspection  of  placards  or  markings  in  the  cockpit  before  issuing  special 
airworthiness  certificates.  They  also  do  not  provide  adequate  guidance  or  evaluation  concerning 
the  inspection  of  the  placement  or  operation  of  essential  controls.  Because  accident  data  from  a 
Safety  Board  study  suggest  that  the  ergonomics  of  cockpit  control  placement  can  be  critical  in  the 
safe  operation  of  airplanes,16  the  Board  is  concerned  that  a  lack  of  requirements  for  standardized 
placards,  markings,  or  appropriate  placement  of  essential  system  controls  could  jeopardize  flight 
safety  in  experimental,  amateur-built  airplanes.  Therefore,  the  Safety  Board  believes  that  the 
FAA  should  amend  FAA  Order  8130.2C  to  specify  that,  before  the  issuance  of  special 
airworthiness  certificates,  experimental,  amateur-built  airplanes  should  be  inspected  for  needed 
placards  and  markings  on  cockpit  instruments  and  for  the  appropriate  placement  and  operation  of 


14  Safety  Board  staff  found  that  the  Glasair  training  syllabus  directed  the  pilot  to  answer  multiple  questions 
concerning,  among  other  subjects,  fuel  system  descriptions,  operations,  and  emergency  procedures. 

15  DARs  are  private  persons  designated  by  the  FAA  to  act  in  its  behalf  in  the  inspection  of  aircraft  and  to  issue 
airworthiness  certificates. 

16  A  1974  NTSB  special  study,  U.S.  General  Aviation  Accidents  Involving  Fuel  Starvation  (AAS-74-01)  analyzed 
fuel  starvation  aircraft  accidents  from  1970  through  1972.  Among  the  recommendations  in  the  report,  which  were 
intended  to  reduce  the  number  of  fuel  starvation  accidents,  the  Safety  Board  asked  the  FAA  to  amend  14  CFR  Part 
23  to  include  specifications  for  standardizing  fuel  selector  valve  designs,  displays,  and  modes  of  operation  (A-74- 
39).  This  recommendation  was  classified  “Closed — Acceptable  Action”  after  the  FAA  changed  Part  23.  Currently, 
14  CFR  Part  23.777  addresses  the  physical  placement  of  controls  and  states  that  "each  fuel  feed  selector  control 
must.. .be  located  and  arranged  so  that  the  pilot  can  see  and  reach  it  without  moving  any  seat  or  primary  flight  control 
when  his  seat  is  at  any  position  in  which  it  can  be  placed.”  The  mapping  of  fuel  selector  control  positions  in 
accordance  with  natural  expectations  is  addressed  in  14  CFR  Part  23.779,  which  requires  that  fuel  selector  control 
movement  be  consistent  with  tank  selection  (i.e.,  left  for  left  tanks;  right  for  right  tanks). 
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essential  system  controls  to  ensure  that  they  provide  clear  marking,  easy  access,  and  ease  of 
operation. 

The  Safety  Board  notes  that  the  requirement  for  an  annual  inspection  (referred  to  as  a 
condition  inspection)17  of  experimental,  amateur-built  airplanes  is  contained  in  a  limitations 
letter  attached  to  the  special  certificate  of  airworthiness.18  Paragraphs  141  and  142  of  Order 
8130.2C  generally  describe  the  issuance  of  experimental  operating  limitations,19  which  always 
include  the  inspection  requirements.  The  operating  limitations  state  that  the  condition  inspection 
shall  be  recorded  in  the  aircraft  maintenance  records  in  accordance  with  the  scope  and  detail  of 
14  CFR  Part  43,  Appendix  D  or  other  FAA-approved  programs  and  that  the  condition  inspection 
is  equivalent  to  an  annual  inspection. 

The  operations  limitations  may  require  the  use  of  placards  and  markings  to  ensure  the 
safe  operation  of  the  aircraft.  The  Safety  Board  is  not  aware  of  any  recurrent  requirement  to 
inspect  placards  and  markings  in  the  cockpit  and  on  essential  system  controls  to  ensure  that  they 
display  appropriate  and  accurate  information. 

The  Safety  Board  is  concerned  about  the  lack  of  requirements  to  periodically  inspect  the 
placards,  markings,  and  essential  controls  in  experimental,  amateur-built  aircraft.  Periodic 
inspection  of  these  items  is  necessary  to  ensure  that  they  consistently  display  appropriate  and 
accurate  information  to  the  pilot  for  flight  safety.  Therefore,  the  Safety  Board  believes  that  the 
FAA  should  amend  FAA  Order  8130.2C  to  specify  that  inspection  limitations  be  issued  with 
special  airworthiness  certificates  for  amateur-built  airplanes  requiring  that  the  annual  condition 
inspection  include  an  inspection  for  needed  placards  and  markings  on  cockpit  instruments  and 
the  appropriate  operation  of  essential  controls  to  ensure  that  they  provide  clear  marking,  easy 
access,  and  ease  of  operation. 

Another  concern  of  the  Safety  Board  was  the  limited  amount  of  transition  training 
received  by  the  accident  pilot  in  the  accident  airplane.  A  review  of  the  pilot’s  FAA  airman  and 
medical  records  indicated  that  he  held  a  private  pilot  certificate  with  airplane  ratings  for  single 
and  multiengine  land,  single-engine  sea,  instrument  airplane,  glider,  and  a  Lear  Jet  type  rating. 
The  pilot’s  logbook  was  not  recovered  after  the  accident;  however,  his  total  flight  time  reported 
on  his  last  physical  was  2,750  hours,  including  15  hours  in  the  preceding  6  months.  The  Safety 
Board’s  investigation  revealed  that  the  pilot  purchased  the  accident  airplane  on  September  27, 
1997,  and  that  his  pilot-in-command  experience  in  the  airplane  was  limited  to  a  1/2-hour  ground 
and  flight  checkout  on  the  day  before  the  accident  and  a  1-hour  solo  flight.  According  to  an  air 
traffic  control  communication  tape,  the  duration  of  the  checkout  flight  was  only  10  minutes,  and 
the  pilot  departed  about  20  minutes  later  for  a  1-hour  solo  flight  to  his  home  airport.  The  Safety 
Board  learned  that  the  pilot  had  been  on  three  previous  demonstration  flights  in  Long-EZ 
airplanes  (during  all  of  which  he  occupied  the  rear  seat)  but  could  not  determine  how  much,  if 


Condition  inspection  is  defined  in  the  Airworthiness  Inspector’s  Handbook,  FAA  Order  8300.10,  Chapter  25. 

The  limitations  letter  lists  requirements  for  continued  airworthiness. 

19 

The  operating  limitations  are  designed  for  each  aircraft.  The  FAA  inspector  may  impose  any  operational 
limitations  deemed  necessary  in  the  interest  of  safety. 
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any,  pilot  training  he  received  during  these  flights.20  The  Safety  Board  found  no  evidence  of  the 
pilot  having  any  other  flight  experience  in  Long-EZ  airplanes. 

On  the  basis  of  his  limited  flight  experience  in  this  type  of  airplane,  the  Safety  Board 
concludes  that  the  pilot  likely  did  not  have  the  necessary  knowledge  and  skills  to  efficiently 
operate  it  during  the  emergency  circumstances  of  the  accident  flight.  Had  the  pilot  been  more 
skilled  in  the  operation  of  the  flight  controls  and  knowledgeable  of  the  unusual  fuel  selector,  the 
accident  might  have  been  avoided  or  the  severity  of  the  accident  could  have  been  reduced.21 

The  Safety  Board  is  aware  that  some  advanced,22  experimental,  amateur-built  airplane 
training  organizations  have  published  training  syllabi.  The  Safety  Board  also  notes  that  insurers23 
of  amateur-built  airplanes,  similar  to  or  more  advanced  than  the  Long-EZ,  have  sometimes 
required  a  training  syllabus  and  detailed  aircraft  inspection  as  conditions  for  providing  insurance 
coverage  for  the  pilot/owner.  The  Safety  Board  has  found  that  the  accident  rates  for  high 
performance,  complex,  and  unusual  aircraft  may  be  substantially  reduced  by  requiring 
pilot/owner-operators  to  undergo  type-specific  ground  and  flight  training.  For  example,  it  was 
found  that  when  formal  flight  and  ground  training  was  required  for  pilots  of  Piper  PA-46  Malibu 
airplanes,  the  fatal  accident  rate  in  that  airplane  model  was  reduced.24  Further,  the  Aviation 
Insurance  Association  (AIA)  has  reported  that  using  and  closely  adhering  to  a  specified  training 
syllabus  has  considerably  reduced  the  accident  rate  in  the  Glasair  and  Lancair  experimental, 
amateur-built  airplanes.25  Additionally,  the  Safety  Board  found  accident  rates  of  Robinson  R22 
helicopters  were  substantially  reduced  when,  in  response  to  the  Safety  Board’s  recommendations, 
the  FAA  issued  Special  Federal  Aviation  Regulation  (SFAR)  73  on  February  23,  1995, 


According  to  the  Rutan  engineer  who  gave  the  first  demonstration  flight,  the  pilot  said  he  had  no  previous  flights 
in  Long-EZ  airplanes.  Only  one  demonstration  flight  was  in  N555JD. 
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The  in-flight  manipulation  of  the  fuel  selector,  the  location  and  accuracy  of  the  fuel  quantity  sight  gauges,  and 
using  the  installed  fuel  totalizer  probably  would  have  been  included  in  formalized  transition  training. 

“Advanced”  experimental  airplanes  are  typically  faster,  aerodynamically  cleaner,  and  are  more  complex  than  most 
amateur-built  aircraft.  The  Safety  Board  staff  found  three  companies  that  sell  kits  for  experimental,  amateur-built 
airplanes  and  that  provide  formal,  type-specific  ground  and  flight  training  to  the  owner/pilots  of  these  airplanes.  The 
Glasair  training  plan  provides  for  approved  certificated  flight  instructors  located  in  different  areas  of  the  country  that 
will  conduct  the  formal  course  of  instruction  to  the  pilot.  The  Lancair  plan  provides  ground  instruction  at  its  factory 
and  provides  a  factory  test  pilot  to  fly  at  the  builder’s  location  in  the  builder’s  airplane  through  the  first  10  hours  of 
the  flight  test  program.  The  Velocity  plan  has  east  and  west  coast  centers  that  provide  formal  ground  and  flight 
instruction.  Safety  Board  staff  found  that  each  company,  in  conjunction  with  insurers,  mandates  its  specific  course 
of  training.  Each  of  these  formal  programs  provides  certification  to  the  insurers  of  the  experimental,  amateur-built 
airplane  when  pilots  complete  the  prescribed  training. 

According  to  the  AIA,  accident  rates  for  the  Glasair  and  Lancair  airplanes  have  dramatically  dropped  because  of 
insurers  requiring  pilots’  use  of  type-specific  training  syllabi. 

24  A  spokesman  for  AVEMCO  (a  major  aircraft  insurer)  reported  to  the  Safety  Board  that,  as  a  condition  of 
insurance,  his  company  requires  that  all  PA-46  pilots  (and  pilots  of  other  pressurized  airplanes)  attend  formal 
training  that  includes  completion  of  a  type-specific  training  syllabus.  These  programs  reportedly  reduced  the 
accident  rates  of  these  airplanes.  The  Safety  Board’s  accident  data  show  no  PA-46  fatal  accidents  during  1992  and 
1997,  1  in  1993,  2  in  1998,  and  3  in  1994,  1995,  and  1996,  respectively.  None  of  the  accidents’  probable  causes  is 
attributed  to  inadequate  transition  training. 

The  AIA  has  reported  that  by  requiring  type-specific  transition  training  in  conjunction  with  the  airplane 
manufacturer,  the  accident  rates  for  those  aircraft  were  significantly  lowered. 
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promulgating  special  training,  proficiency,  and  operational  rules  for  pilots  operating  these 
helicopters.26  The  SFAR  required  specific  training  in  this  highly  responsive  helicopter  before  a 
pilot  could  operate  it  as  the  pilot-in-command. 

A  1998  query  showed  that  the  FAA’s  aircraft  database  contains  about  20,244 
experimental,  amateur-built  aircraft,  including  1,200  Long-EZ  airplanes.27  According  to  the 
EAA,  about  8,000  additional  aircraft  were  in  the  process  of  being  built  by  amateur  builders  in 
1997,  and  in  the  next  few  years,  a  significant  number  of  amateur-built  airplanes  will  be  sold  to 
non-builders.  As  previously  mentioned,  experimental,  amateur-built  aircraft  are  not  required  to 
be  certificated  to  14  CFR  Part  23  certification  standards  and,  therefore,  may  well  have  control 
locations,  functions,  and  markings  that  do  not  conform  to  the  original  design  plans.  Because  of 
these  and  other  differences  (such  as  performance  and  handling  characteristics)  between 
experimental,  amateur-built  aircraft  and  Part  23  aircraft,  quality  transition  training28  of  pilots 
flying  them  is  critical  to  their  safe  operation. 

The  Safety  Board  is  aware  of  the  EAA’s  Flight  Advisor  Program,  which  is  designed  to 
help  amateur  airplane  builders  safely  perform  their  first  flight.  In  this  program,  advisors  with 
substantial  flying/building  experience  offer  free  advice,  videos,  and  written  guidance  to  help 
make  builders’  first  test  flight  a  safe  one.  The  advisors  do  not  provide  flight  training  but  offer 
training  suggestions  and  options  for  the  pilot  to  consider.  This  program,  which  the  EAA  claims 
has  resulted  in  reduced  first-flight  accident  rates,29  is  generally  known  among  EAA  members  but 
not  among  the  general  pilot  population. 

Such  programs  can  provide  an  added  margin  of  safety  for  pilots  inexperienced  in  the 
operation  of  unusual  or  unique,  non-Part  23-certificated  aircraft.  Unfortunately,  no  FAA  ACs, 
pamphlets,  or  programs  exist  that  require  or  encourage  pilots  who  did  not  build  their 
experimental  category  airplanes  to  receive  type-specific  transition  flight  training.  FAA 
publications  and  programs  also  lack  emphasis  on  the  benefits  of  formalized  syllabi  for  such 
transition  training.  The  Safety  Board  concludes  that  an  expanded  flight  advisor  program  could 
substantially  reduce  the  experimental,  amateur-built  airplane  accident  rate.  Therefore,  the  Safety 
Board  believes  that  the  EAA  should  establish,  in  conjunction  with  the  FAA  and  the  AIA,  a 
cooperative  program  that  strongly  encourages  pilots  transitioning  to  unusual  or  unfamiliar 
amateur-built,  experimental  category  airplanes  to  undergo  formalized,  type-specific  transition 
training  similar  to  that  provided  to  pilots  of  some  advanced,  experimental,  amateur-built 
airplanes. 


For  more  information,  see  NTSB  Special  Investigation  Report,  NTSB/SIR-96/03,  Robinson  Helicopter  Comnanv 
-R22  Loss  of  Main  Rotor  Control  Accidents,  dated  April  2,  1QQ6 

According  to  the  EAA,  4,500  Long-EZ  plans  were  sold.  The  EAA  estimates  that  about  95,000  plans  or  kits  have 
been  sold  to  prospective  amateur  builders  of  all  aircraft  types  in  the  past  10  years. 

The  Safety  Board  considers  quality  transition  training  to  be  type-specific,  formal  transition  training  that  adheres  to 
a  training  syllabus. 

The  EAA  has  reported  significant  accident  rate  reductions  since  the  Flight  Advisor  program  was  started  in  1995. 
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Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Experimental 
Aircraft  Association: 

Establish,  in  conjunction  with  the  Federal  Aviation  Administration  and  the 
Aviation  Insurance  Association,  a  cooperative  program  that  strongly 
encourages  pilots  transitioning  to  unusual  or  unfamiliar  amateur-built, 
experimental  category  airplanes  to  undergo  formalized,  type-specific  transition 
training  similar  to  that  provided  to  pilots  of  some  advanced,  experimental, 
amateur-built  airplanes.  (A-99-9) 

Also  as  a  result  of  its  investigation,  the  Safety  Board  issued  Safety  Recommendations 
A-99-5  through  -7  to  the  FAA  and  A-99-8  to  the  AIA. 

The  National  Transportation  Safety  Board  is  an  independent  Federal  agency  with  the 
statutory  responsibility  “...to  promote  transportation  safety  by  conducting  independent  accident 
investigations  and  by  formulating  safety  improvement  recommendations”  (Public  Law  93-633). 
The  Safety  Board  is  vitally  interested  in  any  actions  taken  as  a  result  of  its  safety 
recommendations  and  would  appreciate  a  response  from  you  regarding  action  taken  or 
contemplated  with  respect  to  the  recommendation  in  this  letter.  Please  refer  to  Safety 
Recommendation  A-99-9  in  your  reply. 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMIDT, 
GOGLIA,  and  BLACK  concurred  with  this  recommendation. 
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Brief  of  Accident  (Continued) 
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National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  FEB  1  9  1999 

In  reply  refer  to:  A-99-10  and -11 

Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  February  9,  1998,  N845AA,  a  Boeing  727-223  (B-727),  operating  as  American 
Airlines  flight  1340,  landed  180  feet  short  of  the  runway  14R  threshold  at  the  Chicago  O’Hare 
International  Airport  while  attempting  a  category  II  instrument  landing  system  approach.  Of  the 
1 16  passengers  and  6  crewmembers  on  board,  22  passengers  and  1  crewmember  reported  minor 
injuries.  The  airplane  was  substantially  damaged. 

During  the  ground  impact  sequence,  the  main  landing  gear  and  aft  air  stairs  separated 
from  the  airplane,  and  the  nose  gear  folded  back  into  the  avionics  compartment.  The  airplane 

came  to  rest  on  its  fuselage  along  the  south  side  of  runway  14R  and  2,245  feet  from  the  initial 
impact  point. 

Although  the  investigation  continues,  the  Safety  Board  has  identified  two  safety  issues 
that  affect  the  safety  and  survivability  of  passengers  and  their  rapid  egress  during  an  emergency 
evacuation. 

The  first  safety  issue  was  the  blockage  of  the  aisle  to  the  forward  entry  door  (L-l)  and  the 
partial  blockage  of  the  forward  galley  door  (R-l  exit)  caused  by  the  open  door  to  the  stowage 
compartment  (formerly  used  to  stow  liferafts)  near  the  R-l  exit.  Also,  several  of  the  overhead 
ceiling  panels  separated  from  their  support  structure,  but  they  did  not  block  the  aisle  because 
lanyards  attached  to  the  panels  and  ceiling  supports  prevented  them  from  falling  down 
completely. 

The  B-727  is  equipped  with  four  single  door  liferaft  ceiling  stowage  compartments  that 
contain  liferafts  when  the  airplane  is  being  operated  as  an  extended  over-water  flight.  For  flights 
that  are  not  operated  over  water,  the  stowage  compartments  may  be  empty.  The  4  X  2  foot  door 
panels  are  latched  along  their  forward  and  aft  edges;  however,  the  doors  were  not  equipped  with 
any  device  to  prevent  them  from  falling  down  and  blocking  the  aisle.  The  ceiling  panels  installed 
fore  and  aft  of  the  liferaft  stowage  compartments  were  equipped  with  lanyards  that  limit  their 
downward  travel  and  prevent  the  panel  from  blocking  the  aisle. 
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The  Safety  Board  previously  addressed  a  similar  issue  during  its  investigation  of  the 
United  Airlines  B-747-122,  N4713U,  accident  near  Honolulu,  Hawaii,  on  February  24, 1989.  The 
accident  involved  the  in-flight  separation  of  a  cargo  door  and  subsequent  emergency  landing  and 
evacuation  of  the  airplane.  During  the  accident,  two  liferaft  stowage  compartments  had  opened 
downward  and  blocked  the  R-2  and  L-2  exits.  In  its  accident  report,  the  Safety  Board  issued 
Safety  Recommendation  A-90-59,  which  asked  the  Federal  Aviation  Administration  (FAA)  to  do  • 
the  following: 

Issue  an  airworthiness  directive  (AD)  to  require  that  stronger  latches  be  installed 

in  oversized  storage  compartments  that  formerly  held  liferafts  on  all  B-747 

airplanes  and  also  limit  the  distance  that  these  compartments  can  be  opened. 

On  October  7,  1991,  the  FAA  issued  AD  91-22-05,  applicable  to  B-747s.  The  AD 
required  the  replacement  of  overhead  stowage  compartment  doors  with  improved  doors  and 
improved  counterbalance  assemblies  and  operational  checks  of  associated  equipment  for  certain 
stowage  compartments  located  near  entry  door's  or  the  deactivation  of  those  compartments.  Based 
on  the  issuance  of  the  AD,  the  Board  classified  Safety  Recommendation  A-90-59  “Closed — 
Acceptable  Action”  on  November  1, 1991. 

The  safety  recommendation  and  the  AD  were  not  applicable  to  commercial  transport- 
category  airplanes  other  then  B-747s.  The  Safety  Board  is  concerned  that  if  there  had  been  a 
need  for  immediate  evacuation,  rapid  egress  would  not  have  been  possible  at  door  L-l  because  it 
was  blocked  by  the  open  liferaft  stowage  compartment.  Also,  a  liferaft  stowage  compartment 
door  could  open  during  a  hard  landing  or  turbulence  and  could  injure  a  flight  attendant.  Thus, 
the  Safety  Board  believes  that  the  FAA  should  identify  all  airplanes  operated  under  Title  14  Code 
of  Federal  Regulations  Part  121  with  liferaft  ceiling  stowage  compartments  or  compartments  that 
formerly  held  liferafts  that  open  downward  and  issue  an  AD  to  limit  the  distance  that  those 
compartments  can  open. 

The  second  safety  issue  that  the  Safety  Board  has  identified  in  its  investigation  of  the 
flight  1340  accident  involved  two  passenger  seatbelts  that  released  at  their  seat  attachments 
during  the  airplane’s  impact  with  the  ground.  The  seatbelts  on  the  aisle  side  of  seats  25C  and  27C 
remained  buckled  but  became  unhooked  at  their  seat  shackles.  The  passenger  in  seat  25C  was 
not  injured;  he  stated  that  he  noticed  that  his  seatbelt  had  separated  (at  the  seat  attachment)  when 
he  reached  down  to  unbuckle  it.  However,  the  passenger  in  seat  27C  reported  minor  injuries;  he 
stated  that  his  seatbelt  released  during  the  airplane’s  second  impact.  After  his  seatbelt  released, 
he  pitched  forward  to  the  left,  and  struck  the  seat  in  front  of  him. 

Both  seatbelt  assemblies  are  of  a  design  commonly  used  in  commercial  airplanes.  The 
seatbelt  assembly  consists  of  the  standard  release  buckle,  webbing,  and  an  attachment  fitting  with 
a  spring  clip  keeper  at  each  end  of  the  belt  (see  figure  1).  The  attachment  fitting  clips  over  a 
shackle  that  is  bolted  to  the  seatframe. 
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Figure  1 . — Seatbelt  Assembly 


The  Safety  Board  has  previously  addressed  the  issue  of  seatbelts  becoming  unhooked. 
During  its  investigation  of  a  British  Aircraft  BAC-1-11  that  encountered  severe  turbulence  near 
Orlando,  Florida,  on  May  24,  1988,  the  Safety  Board  found  that  three  passenger  seatbelts  had 
detached  during  the  turbulence.  The  passengers  were  displaced  in  their  seats  and  sustained  minor 
injuries.  Safety  Board  investigators  and  Civil  Aeromedical  Institute  (CAMI)  engineers 
conducted  tests  at  CAMI  to  identify  ways  that  seatbelt  attachment  fittings  could  detach  from  the 
shackles  bolted  to  the  seatframes.  The  tests  revealed  that  when  the  bolt  used  to  fasten  the  shackle 
to  the  seatframe  is  overtightened,  the  shackle  cannot  move  vertically  to  self-center,  preventing 
the  seatbelt  end  fitting  from  centering  on  the  shackle.  When  this  condition  occurs,  the  end  fitting 
cannot  align  with  the  seat  occupant,  and  minimal  side  loads  can  force  open  the  end  fitting’s 
spring-loaded  keeper  and  detach  the  end  fitting  from  the  shackle. 

Consequently,  the  Safety  Board  issued  Safety  Recommendations  A-90-20  and  A-90-21, 
which  asked  the  FAA  to  do  the  following: 

A-90-20 

Issue  a  maintenance  alert  to  principal  maintenance  inspectors  (PMIs)  to  inspect 
seatbelt  attachment  shackles  installed  on  passenger  seats  on  air  carrier,  air  taxi, 
and  commercial  airplanes  to  verify  that  the  correct  bolts  are  used  to  fasten  the 
shackles  to  the  seats,  the  bolts  are  torqued  to  the  correct  value,  and  the  shackles 
are  free  to  self-center  after  the  correct  torque  has  been  applied  to  the  bolts. 
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A-90-21 

Require  PMIs  to  verify  that  air  carrier,  air  taxi,  and  commercial  operators  have 

maintenance  instructions  for  the  proper  installation  of  passenger  seatbelt 

attachment  shackles. 

On  May  3,  1991,  the  FAA  issued  Notice  8300.101,  “Seatbelt  Maintenance 
Requirements.”  The  notice  identified  seatbelt  maintenance  discrepancies  and  recommended  that 
PMIs  alert  operators  of  the  need  to  inspect  seatbelt  attachment  shackles  to  ensure  that  correct 
shackle  bolts  are  installed,  the  bolts  are  torqued  to  the  correct  value,  and  the  shackles  are  free  to 
self-center  after  the  correct  torque  has  been  applied  to  the  bolts.  The  notice  also  asked  PMIs  to 
review  and  ensure  that  the  carrier’s  maintenance  and  inspection  procedures  include  periodic 
inspection  of  seatbelt  restraint  systems;  notify  the  air  carrier,  in  writing,  of  any  problems  or 
discrepancies  that  require  changes  to  the  inspection  program;  inspect  and  replace  unserviceable 
seatbelts  during  ramp  and  en  route  inspections;  and  ascertain  that  quality  control  and  assurance 
exists  to  maintain  die  integrity  of  seatbelts  and  restraints.  The  Safety  Board  subsequently 
classified  the  recommendations  “Closed — Acceptable  Action.” 

During  the  investigation  of  the  American  Airlines  flight  1340  accident,  Safety  Board 
investigators  examined  the  seatbelt  shackles  at  seats  25C  and  27C.  In  contrast  to  the  CAMI 
findings  in  the  earlier  detachments,  both  shackles  were  found  to  move  freely  in  the  vertical 
direction,  and  the  torque  values  for  each  shackle  bolt  did  not  exceed  the  recommended  torque 
limits  of  65-  to  90-inch  pounds.  The  Safety  Board  was  unable  to  determine  why  the  seatbelts 
became  unhooked  from  the  shackles  at  seats  25C  and  27C. 

On  April  18,  1998,  a  seatbelt  released  from  its  seat  attachment  when  a  Boeing  747-200, 
N623FF,  operated  by  Tower  Air,  Inc.  as  flight  37,  encountered  turbulence  about  120  nautical 
miles  east  of  Kennebunkport,  Maine,  at  flight  level  350.  Investigation  of  the  incident  revealed 
that  a  passenger’s  seatbelt  released  at  seat  58F  during  the  encounter  with  turbulence  and  that  a 
flight  attendant  had  reattached  the  seatbelt  to  its  shackle  after  the  turbulence  had  ended. 

The  Safety  Board  is  concerned  that  the  current  seatbelt  fitting  with  a  spring  clip  keeper 
that  clips  over  a  shackle  does  not  provide  enough  assurance  that  the  seatbelt  will  remain  fastened 
to  a  seat  during  turbulence  or  during  an  emergency  landing.  The  Safety  Board  is  also  concerned 
that  operators  may  not  be  aware  of  this  unsafe  condition  and  that  appropriate  corrective  measures 
have  not  been  taken  to  alert  operators  and  to  prevent  this  condition  from  occurring.  Thus,  the 
Safety  Board  believes  that  the  FAA  should  reexamine  the  design  of  seatbelts  installed  on 
passenger  seats  on  air  carrier,  air  taxi,  and  commercial  airplanes  to  determine  the  reason  some 
have  become  unhooked  from  their  seat  attachments  during  turbulence  or  a  hard  landing  and 
establish  a  suitable  means  of  ensuring  that  the  seatbelts  remain  attached  to  their  shackles  during 
all  modes  of  flight. 
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Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 


c 


% 


Identify  all  airplanes  operated  under  Title  14  Code  of  Federal  Regulations  Part 
121  with  liferaft  ceiling  stowage  compartments  or  compartments  that  formerly 
held  liferafts  that  open  downward  and  issue  an  airworthiness  directive  to  limit  the 
distance  that  those  compartments  can  open.  (A-99-10) 

Reexamine  the  design  of  seatbelts  installed  on  passenger  seats  on  air  carrier,  air 
taxi,  and  commercial  airplanes  to  determine  the  reason  some  have  become 
unhooked  from  their  seat  attachments  during  turbulence  or  a  hard  landing  and 
establish  a  suitable  means  of  ensuring  that  the  seatbelts  remain  attached  to  their 
shackles  during  all  modes  of  flight.  (A-99-1 1) 


Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMIDT, 
GOGLIA,  and  BLACK  concurred  in  these  recommendations. 


Chairman 


# 

* 


National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  February  22,  1999 
In  reply  refer  to:  A-99-12  through  -15 

Honorable  Jane  F.  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  March  30,  1998,  Royal  Airlines  flight  311,  a  Boeing  727-212  airplane,  registered  in 
Canada  as  C-FRYS,  experienced  an  uncontained  failure1  of  the  low  pressure  turbine  (LPT)  in  the 
No.  2  engine,  a  Pratt  &  Whitney  (P&W)  JT8D-17A,  during  the  takeoff  roll  at  the  Fort 
Lauderdal e-Hollywood  International  Airport,  Fort  Lauderdale,  Florida.  The  flightcrew  reported 
that  at  approximately  100  knots,  they  felt  a  thud,  and  the  engine  fail  light  in  the  cockpit 
illuminated.  The  takeoff  was  rejected,  and  the  No.  2  engine  fire  warning  light  illuminated.  The 
flightcrew  discharged  both  fire  extinguishing  bottles  into  the  No.  2  engine  nacelle,  stopped  the 
airplane  on  an  adjacent  taxiway,  and  initiated  an  evacuation  of  the  airplane.  Of  the  186  revenue 
passengers,  2  infants,  and  8  flight  crewmembers  on  board,  10  passengers  sustained  injuries  during 
the  evacuation.  The  airplane  was  operating  on  an  instrument  flight  rules  flight  plan  under  the 
provisions  of  14  Code  of  Federal  Regulations  Part  129  as  an  international  charter  passenger  flight 
from  Fort  Lauderdale  to  Toronto,  Canada. 

Because  the  aiiplane  was  operated  by  a  Canadian-certificated  air  carrier  the 
Transportation  Safety  Board  of  Canada  assisted  in  the  National  Transportation  Safety  Board’s 
investigation  under  the  provisions  of  Annex  13  to  the  International  Convention  on  Civil  Aviation. 
Because  the  engine  had  been  previously  repaired  by  Volvo  Flygmotor  AB,2  Trollhattan,  Sweden, 
the  Safety  Board  was  also  assisted  by  the  Swedish  Board  of  Accident  Investigation  during  the 
review  of  the  failed  engine’s  repair  records. 


The  examination  of  the  airplane  revealed  that  the  No.  2  engine’s  left  and  right  aft  cowl 
doors  had  numerous  penetrations  and  fire-blistered  paint  just  aft  of  the  LPT;  however,  the 
airplane  sustained  no  other  damage.  The  fire  was  caused  by  fuel  and  oil  from  several  severed  lines 
in  the  aft  section  of  the  engine. 


'  An  ““contained  engine  failure  occurs  when  an  internal  part  of  the  engine  foils  and  is  ejected  through  the  cowling 
or  causes  other  pieces  of  the  engine  to  be  ejected  through  the  cowling. 

Volvo  Flygmotor  AB  has  since  changed  its  name  to  Volvo  Aero  Coiporation. 
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The  JT8D  engine’s  low  pressure  rotor  system  is  made  up  of  a  two-stage  fan,  which 
consists  of  the  1st  and  2nd  stage  fan  rotors,3  and  a  four-stage  low  pressure  compressor  (LPC), 
which  consists  of  the  3rd,  4th,  5th,  and  6th  stage  compressor  rotors.  The  two-stage  fan  and  four- 
stage  compressor  are  joined  to  the  three-stage  LPT,  which  consists  of  the  2nd,  3rd,  and  4th  stage 
turbine  rotors,  by  a  drive  shaft,  all  of  which  rotate  as  one  unit  under  normal  conditions  (see 
figure  1).  The  examination  of  the  incident  engine  revealed  that  the  1“  and  2nd  stage  fan  rotors  and 
the  3rd  stage  compressor  rotor  rotated  together  but  independently  from  the  remainder  of  the  low 
pressure  rotor  system  from  the  4th  stage  compressor  rotor ‘rearward.  The  examination  also 
showed  that  the  2nd,  3rd,  and  4th  stage  LPT  disks  were  intact  but  that  all  of  the  LPT  blades  were 
fractured  adjacent  to  the  blade  root  platforms,  and  most  of  the  LPT  vanes  were  missing. 
Although  the  engine  was  outfitted  with  an  LPT  containment  shield,  as  required  by  Airworthiness 
Directive  (AD)  94-20-09,  the  containment  shield  was  broken  into  three  pieces,  and  the  engine  was 
cut  in  two  just  aft  of  the  LPT  by  liberated  LPT  blades.4 


Figure  1.  JT8D  engine 

The  4  stages  of  the  JT8D  engine’s  LPC  are  held  together  by  12  long  bolts,  called  LPC  rear 
tierods,  that  pass  through  alternating  disks  and  spacers  (see  figure  2).  The  disassembly  of  the 
Royal  Airlines  LPC  revealed  that  one  LPC  rear  tierod,  part  number  (PN)  789550,  was  fractured 
transversely  across  the  tierod’s  4th  stage  compressor  disk  land.5  The  entire  fracture  face  on  the 


3  A  rotor  stage  refers  to  the  compressor  or  turbine  disk  or  hub  and  the  respective  installed  blades. 

4  The  aft  section  of  the  engine  and  thrust  reverser  assembly  remained  attached  to  the  airplane  by  the  aft  engine 
mount  cone  bolt. 

5  A  tierod  compressor  disk  land  is  a  larger  diameter  section  of  the  tierod  that  passes  through  the  compressor  disk’s 
tierod  hole.  The  diameter  of  the  tierod  compressor  disk  land  is  about  0.010  inch  less  than  the  diameter  of  the 
compressor  disk’s  tierod  hole. 
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tierod  had  surface  corrosion,  suggesting  that  the  tierod  had  been  broken  for  some  time.  Because 
of  overstress,  the  1 1  remaining  LPC  rear  tierods  were  fractured  at  their  forward  ends  between  the 
3"1  stage  compressor  disk  lands  and  the  tierod  nut  threads.  All  six  of  the  recovered  tierod  nuts 
and  ends  had  numerous  pockmarks  on  one  side,  and  the  tierod  ends  were  bent  away  from  the 
pockmarks.  The  pockmarks  and  bending  damage  suggest  that  after  the  initial  tierod  fractured  and 
was  liberated  from  the  compressor,  it  tumbled  around  in  the  cavity  at  the  front  of  the  LPC  and 
impacted  the  other  tierod  nuts  and  ends  until  they  eventually  fractured,  causing  the  compressor  to 
^  separate  between  the  3rd  and  4th  stage  rotors  and  the  engine  to  fail.  Eleven  equally  spaced  fan  exit 

vanes  had  the  imprints  of  the  tierod  nuts  on  the  leading  edge,  indicating  that  the  11  remaining 
•  tierods  fractured  simultaneously  when  the  engine  failed. 


1  LPC  rear  tierod 
fractured  here 


Disk  land 


Figure  2.  Cross-section  of  the  JT8D  fan  and  LPC  and  view  of  an  LPC  rear  tierod 


The  Safety  Board’s  examination  of  the  LPC  rear  tierod  with  the  corroded  fracture  face 
revealed  that  a  fatigue  fracture  originated  from  a  small  area  of  galling6  on  the  4th  stage  compressor 
disk  land.  On  July  7,  1982,  as  a  result  of  33  LPC  rear  tierod  fractures  at  the  3rd  and  4th  stage  disk 
land  locations  that  caused  damage  in  JT8D  engines,  P&W  issued  Service  Bulletin  (SB)  5407.7 


6  Galling  is  a  condition  whereby  excessive  friction  between  high  spots  results  in  localized  welding  with  the 
subsequent  tearing  and  flaking  away  of  material  that  further  roughens  one  or  both  of  the  rubbing  surfaces. 

Although  a  review  of  Federal  Aviation  Administration  service  difficulty  reports  identified  only  1  event  of  an  LPC 
rear  tierod  fracture,  P&W  advised  that  as  of  September  17,  1998,  it  had  received  reports  of  133  events  of  LPC  rear 
tierod  fractures  in  JT8D-1  through  -17AR  engines. 
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SB  5407  introduced  into  the  JT8D-9  through  -17AR  engines,  the  PN  789550  LPC  rear  tierod, 
which  differs  from  the  old  part  only  in  that  it  is  required  to  have  an  antigalling  coating  applied  to 
the  tierod’ s  compressor  disk  lands.  SB  5407  also  introduced  PN  789552  and  789553  LPC  rear 
tierods  into  the  JT8D-1  through  -7B  engines  and  PN  789774  LPC  rear  tierods  into  the  JT8D-9 
through  -17  engines.  All  of  these  new  parts  are  also  required  to  have  the  antigalling  coating 
applied  to  the  tierod’ s  compressor  disk  lands.  For  newly  manufactured  tierods,  the  antigalling 
coating  is  required  to  be  applied  to  the  compressor  disk  lands  at  the  time  of  manufacture;  but,  for 
previously  operated  tierods,  the  antigalling  coating  can  be  applied  when  the  parts  are  being 
repaired  and  the  part  is  then  reidentified  with  the  appropriate  part  number.  P&W  indicated  that 
the  SB  should  be  complied  with  when  the  LPC  rotor  module  was  disassembled  sufficiently  to 
afford  access  to  the  tierods.  However,  no  AD  was  issued  to  mandate  the  installation  of  the 
tierods  with  the  antigalling  coating. 

The  accident  engine’s  maintenance  records  show  that  the  engine,  including  the  LPC,  had 
been  repaired  by  Volvo  Flygmotor  AB,  on  November  26,  1987,  and  on  April  18,  1991.8  The 
records  for  the  1987  repair  show  that  SB  5407  had  been  complied  with  by  the  installation  of  12 
new  PN  789550  LPC  rear  tierods  in  the  engine.  The  records  for  the  1991  repair  show  that  the 
LPC  rear  tierods  were  removed,  visually  inspected  in  accordance  with  the  JT8D  engine  manual,9 
and  after  being  found  serviceable,  reinstalled  in  the  LPC.  The  postaccident  energy  dispersive 
x-ray  spectroscopy  examination  of  the  compressor  disk  lands  on  the  initially  fractured  tierod  and 
the  other  11  LPC  rear  tierods  in  the  engine’s  LPC  did  not  detect  any  trace  of  the  primary 
constituents  of  the  antigalling  coating  specified  in  the  SB.  Therefore,  the  Safety  Board  concludes 
that  the  antigalling  coating  was  not  applied  to  the  new  LPC  rear  tierods  by  P&W  at  the  time  of 
manufacture.  P&W  stated  that  the  Royal  Airlines  engine  failure  has  been  the  only  one  that 
involved  the  fracture  of  an  LPC  tierod  that  was  supposed  to  have  been  coated  with  the  antigallant. 
The  lack  of  the  antigalling  coating  on  all  12  of  the  LPC  rear  tierods  in  the  Royal  Airlines  engine 
suggests  the  problem  may  be  widespread  since  it  is  unlikely  that  if  only  12  tierods  were 
manufactured  without  the  antigalling  coating,  that  all  of  them  would  be  installed  in  the  same 
engine.  Therefore,  the  Safety  Board  believes  that  the  Federal  Aviation  Administration  (FAA) 
should  require  that  all  P&W  JT8D-1  through  -17 AR  engines  be  disassembled  at  the  next  shop 
visit  and  that  the  LPC  rear  tierods  be  removed,  cleaned,  stripped  of  any  antigallant  and  nickel 
cadmium  (nicad),10  non-destructively  inspected,  replated  with  nicad,  coated  with  the  antigallant, 
and  reinstalled  or  that  new  tierods  coated  with  the  antigallant  be  installed. 

The  Safety  Board  notes  that  the  JT8D  engine  manual  requires  a  fluorescent  penetrant 
inspection  (FPI)11  for  the  high  pressure  turbine  (HPT)  tierods12  and  that  the  JT8D-200  engine 


8  At  the  time  of  both  repairs,  the  engine  was  owned  and  operated  by  Sterling  Airways,  a  Danish  supplemental  air 
carrier  that  subsequently  ceased  operations.  The  engine  also  received  a  hot  section  inspection  by  Gas  Turbine 
Corporation,  East  Granby,  Connecticut,  on  August  24,  1995,  but  the  LPC  was  not  disassembled  at  that  time. 

9  JT8D  Engine  Manual  Task  72-33-13  Insp-01. 

10  Nicad  is  a  two-step  plating  process  of  cadmium  over  nickel  and  is  used  as  a  corrosion  preventative. 

11  FPI  is  a  non-destnrctive  inspection  (NDI)  method  of  detecting  cracks  and  other  surface  anomalies.  The 
inspection  consists  of  applying  to  or  immersing  a  part  in  a  low-viscosity  penetrating  fluid  containing  fluorescent 
dyes  and  allowing  the  fluid  to  penetrate  into  any  surface  defects.  Excess  penetrant  is  removed  and  a  developer  is 
applied  that  acts  as  a  blotter  to  draw  the  penetrant  out  from  any  surface  defects,  which  will  then  luminesce  when 
viewed  under  a  blacklight. 
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manual13  requires  a  magnetic  particle  inspection  (MPI)14  for  that  engine’s  LPC  tierods15  and  an 
FPI  for  the  high  pressure  compressor  and  HPT  tierods.16  However,  the  JT8D  engine  manual 
requires  only  a  visual  examination  for  the  LPC  rear  tierods.  The  Safety  Board  is  concerned  that  a 
visual  inspection  may  not  adequately  determine  the  serviceability  of  these  parts.  Therefore,  the 
Safety  Board  believes  the  FAA  should  require  P&W  to  revise  its  JT8D  engine  manual  to  require 
that  the  LPC  rear  tierods  be  inspected  with  an  appropriate  non-destructive  inspection  (NDI) 
method. 

Although  the  engine  was  equipped  with  an  LPT  containment  shield,  as  required  by  AD 
»  94-20-09,  turbine  blade  fragments  were  still  liberated  through  the  engine  cases  and  nacelle  when 

the  engine  failed.  A  dimensional  inspection  of  the  LPC  and  LPT  disks  revealed  that  the  6th  stage 
LPC  disk  and  the  2nd,  3rd,  and  4th  stage  LPT  disks  had  grown  diametrically.  When  a  compressor 
or  turbine  disk  exceeds  its  rotational  speed  limit,  the  extreme  centrifugal  loads  that  occur  from  the 
overspeed  cause  plastic  deformation  of  the  part,  increasing  its  diametrical  dimensions. 

In  a  letter  to  the  Safety  Board,  P&W  stated  that  its  analysis  of  the  disks’  growth  indicated 
that  the  low  pressure  rotor  had  experienced  a  140  percent  overspeed  of  the  rotor’s  rotational 
speed  limit.  In  its  letter,  P&W  further  stated  that  the  JT8D  engine’s  LPT  containment  shield  had 
been  designed  and  demonstrated  to  withstand  the  impacts  from  fractured  blade  pieces  at  speeds  of 
up  to  120  percent  of  the  rotor’s  rotational  speed  limit.  (In  the  JT8D  engine,  a  120  percent 
overspeed  of  the  LPT  rotor  can  occur  during  an  LPT  shaft  fracture  event.)  In  the  JT8D  engine,  a 
significant  amount  of  the  rotational  energy  produced  by  the  LPT  is  required  to  drive  the  two  fan 
stages  compressing  the  air  entering  the  engine.  When  the  limiting  force  of  the  fan  stages  is 
suddenly  removed  from  the  LPT,  as  might  occur  in  an  LPT  shaft  fracture  or  as  occurred  in  the 
Royal  Airlines  engine  separation,  the  LPT  rotor  rapidly  accelerates  and  exceeds  its  rotational 
speed  limit.  However,  in  an  LPT  shaft  fracture  event,  the  LPT  rotor,  as  it  accelerates,  will  also 
translate  rearward  rapidly  and  the  blades  will  mesh17  with  the  LPT  vanes  to  break  up  the  airfoils 
into  small  fragments  and  limit  the  rotor  speed  to  about  120  percent  of  the  rotational  speed  limit. 

In  the  Royal  Airlines  event,  the  separation  of  the  fan  stages  and  3rd  stage  compressor  rotor 
from  the  rest  of  the  LPC  was  in  front  of  the  No.  2  bearing,  which  is  the  thrust  bearing  for  the  LPC 


12  JT8D  Engine  Manual  Task  72-52-05  Insp-01. 

13  The  JT8D  and  JT8D-200  engines  are  separately  type  certificated  and  are  treated  separately  with  regard  to  engine 
manuals  and  maintenance. 

14  MPI  is  an  NDI  method  of  detecting  cracks  and  other  defects  in  ferromagnetic  materials  such  as  iron  or  steel. 
The  inspection  consists  of  magnetizing  a  part  with  high  amperage,  direct  current  electricity,  thus  creating  magnetic 
lines  of  flux,  then  applying  or  immersing  the  part  in  a  liquid  containing  ferromagnetic  particles  in  suspension. 
The  ferromagnetic  particles  align  themselves  with  the  magnetic  lines  of  flux  on  the  surface  of  the  part  forming  a 
pattern.  If  a  discontinuity  is  present  in  the  material  on  or  near  the  surface,  opposing  magnetic  poles  form  on  either 
side  of  the  discontinuity  and  the  pattern  is  disrupted,  forming  an  indication  of  a  crack.  An  indication  assumes  the 
approximate  size  and  shape  of  the  surface  projection  of  the  discontinuity;  however,  indications  are  more  visible 
when  defects  are  approximately  perpendicular  to  the  magnetic  lines  of  flux. 

15  JT8D-200  Engine  Manual  Task  72-33-13. 

16  JT8D-200  Engine  Manual  Tasks  72-36-20  and  72-52-05,  respectively. 

17  Meshing  is  the  desired  clashing  of  the  turbine  blades  and  vanes  following  a  turbine  rotor  shaft  fracture  that  is 
intended  to  decelerate  the  rotor  and  to  break  the  blades  into  small  particles,  thus  reducing  the  likelihood  of  blades 
penetrating  an  engine  casing. 
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in  the  JT8D  engine.  Because  the  thrust  bearing  is  designed  to  absorb  the  axial  loads  of  the  low 
pressure  rotor,  it  prevented  the  rearward  movement  of  the  LPT.  Consequently,  the  LPT  rotor  in 
the  Royal  Airlines  engine  was  able  to  accelerate  to  about  140  percent  of  the  rotational  speed  limit 
before  the  LPT  blades  fractured  because  the  desired  meshing  action  was  not  able  to  occur.  When 
the  LPT  blades  did  fracture,  they  were  likely  full  or  almost  full  length  in  comparison  to  the  small 
fragments  that  would  have  resulted  if  the  blades  and  vanes  had  meshed.  As  a  result  of  the  larger 
mass  of  the  airfoils  at  the  140  percent  overspeed,  the  fractured  LPT  blades  were  able  to  penetrate 
the  containment  shield,  engine  cases,  and  nacelle. 

The  Safety  Board  is  concerned  that  an  LPC  rear  tierod  fracture  can  lead  to  an  uncontained  * 
engine  failure  because  it  is  likely  that  there  are  other  LPC  rear  tierods  in  service  without  the 
antigalling  coating  that  may  be  subject  to  fracture.  Further,  because  of  the  size  of  the  JT8D-1 
through  -17AR  operating  fleet  and  the  length  of  time  between  shop  visits,  it  will  likely  be  several 
years  before  all  affected  engines  will  be  disassembled  to  permit  an  NDI  of  the  LPC  rear  tierods. 
Therefore,  the  Safety  Board  believes  the  FAA  should  require  a  repetitive  borescope  inspection  of 
P&W  JT8D-1  through  -17AR  engines  to  check  for  fractured  LPC  rear  tierods  and,  if  found, 
require  the  removal  of  those  engines  from  service  for  repair.  Periodic  reinspections  should 
continue  until  an  NDI  of  the  LPC  rear  tierods  is  performed  or  the  tierods  are  replaced. 

A  visual  inspection  of  several  new  PN  789550  JT8D  LPC  rear  tierods  with  the  antigalling 
coating  applied  showed  only  a  subtle  color  difference  between  the  nicad  plating  and  antigalling 
coating.  It  was  possible,  with  a  focused  inspection  in  optimal  lighting  conditions,  to  discern  the 
light  gray  color  of  the  antigalling  coating  from  the  light  greenish-silver  background  color  of  the 
nicad  plating.  However,  the  Safety  Board  is  concerned  that  if  lighting  conditions  are  less  than 
optimal,  if  the  inspection  is  not  focused  on  the  subtle  color  difference  between  the  nicad  and 
antigalling  coatings,  or  if  the  tierods  have  discolored  slightly  in  service,  a  shop  technician  may  not 
be  able  to  readily  detect  the  presence  or  absence  of  the  antigalling  coating  on  these  tierods.  The 
shop  technician  who  installed  the  LPC  rear  tierods  on  the  accident  engine  could  have  reasonably 
assumed  that  the  tierods  were  coated  with  antigallant  at  manufacture,  as  required,  and  therefore, 
might  not  have  examined  the  parts  closely  to  check  for  its  presence.  However,  if  the  antigallant 
were  readily  observable,  the  technician  would  likely  have  noticed  its  absence. 

The  Safety  Board  is  aware  that  many  special  coatings  are  applied  to  parts  used  throughout 
the  aviation  industry  and  that  these  special  coatings  are  not  generally  visually  distinct  so  as  to  be 
readily  detectable.  Thus,  the  problem  of  being  able  to  identify  whether  a  part  has  the  appropriate 
coating  applied  is  not  just  limited  to  JT8D  LPC  rear  tierods,  but  exists  for  many  coated  parts  used 
in  aviation.  Therefore,  the  Safety  Board  believes  that  the  FAA  should  evaluate,  and  if  feasible, 
implement  the  use  of  dyes  and  other  means  to  ensure  coatings  and  surface  treatments  are  easily 
detectable  so  that  shop  technicians  can  determine  if  the  necessary  coatings  have  been  applied  to  a 
part  before  installation  in  an  engine  or  airplane. 
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Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Require  that  all  Pratt  &  Whitney  JT8D-1  through  -17AR  engines  be  disassembled 
at  the  next  shop  visit  and  that  the  low  pressure  compressor  rear  tierods  be 
removed,  cleaned,  stripped  of  any  antigallant  and  nickel  cadmium  (nicad), 
non-destructively  inspected,  replated  with  nicad,  coated  with  the  antigallant,  and 
reinstalled  or  that  new  tierods  coated  with  the  antigallant  be  installed.  (A-99-12) 

Require  Pratt  &  Whitney  to  revise  its  JT8D  engine  manual  to  require  that  the  low 
pressure  compressor  rear  tierods  be  inspected  with  an  appropriate  non-destructive 
inspection  method.  (A-99-13) 

Require  a  repetitive  borescope  inspection  of  Pratt  &  Whitney  JT8D-1  through 
-17AR  engines  to  check  for  fractured  low  pressure  compressor  (LPC)  rear  tierods 
and,  if  found,  require  the  removal  of  those  engines  from  service  for  repair. 
Periodic  reinspections  should  continue  until  a  non-destructive  inspection  of  the 
LPC  rear  tierods  is  performed  or  the  tierods  are  replaced.  (A-99-14) 

Evaluate,  and  if  feasible,  implement  the  use  of  dyes  and  other  means  to  ensure 
coatings  and  surface  treatments  are  easily  detectable  so  that  shop  technicians  can 
determine  if  the  necessary  coatings  have  been  applied  to  a  part  before  installation 
in  an  engine  or  airplane.  (A-99-15) 

Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMIDT, 
GOGLIA,  and  BLACK  concurred  in  these  recommendations. 


National  Transportation  Safety  Board 

Washington,  D.C.  20594 

Safety  Recommendation 


Date:  March  9,  1999 

In  reply  refer  to:  A-99- 1 6  through  - 1 8 


Honorable  Jane  Garvey 
Administrator 

Federal  Aviation  Administration 
Washington,  D.C.  20591 


On  May  11,  1996,  the  crew  of  ValuJet  flight  592,  a  DC-9-32,  reported  smoke  and  fire 
shortly  after  departing  Miami,  Florida.  The  flight  recorders  stopped  about  40  to  50  seconds 
before  the  airplane  crashed  on  its  return  to  the  airport,  killing  all  1 1 1  passengers  and  crew. 

On  July  7,  1996,  TWA  flight  800,  a  Boeing  747-100,  on  an  international  passenger  flight 
from  New  York  to  Paris,  exploded  about  13  minutes  after  takeoff  as  it  was  climbing  through 
13,700  feet.  Both  flight  recorders  stopped  at  the  time  of  the  explosion,  but  the  airplane  did  not 
hit  the  water  off  Long  Island,  New  York,  for  another  40  to  50  seconds.  All  230  people  aboard 
the  airplane  were  killed. 

On  December  19,  1997,  SilkAir  flight  185,  a  Boeing  737,  entered  a  rapid  descent  from 
35,000  feet,  which  ended  with  a  high  speed  impact  in  the  Sumatran  River  near  Palembang, 
Indonesia.  There  were  104  fatalities.  The  Indonesian  investigation,  in  which  the  Safety  Board 
participated,  determined  that  both  flight  recorders  stopped  prior  to  the  airplane  entering  the  rapid 
descent. 

On  September  2,  1998,  Swissair  flight  111,  an  MD-11,  on  a  regularly  scheduled 
passenger  flight  from  New  York  to  Geneva,  Switzerland,  diverted  to  Halifax  after  the  crew 
reported  smoke  in  the  cockpit;  the  airplane  crashed  into  the  waters  near  Peggy’s  Cove,  Nova 
Scotia,  killing  all  229  passengers  and  crew  on  board.  Thus  far,  the  Canadian  Transportation 
Safety  Board’s  (TSB)  investigation,  which  is  being  conducted  in  close  cooperation  and 
coordination  with  the  National  Transportation  Safety  Board  and  Swiss  investigative  authorities, 
has  been  severely  hampered  by  the  lack  of  data  from  the  cockpit  voice  recorder  (CVR)  and 
digital  flight  data  recorder  (DFDR),  which  stopped  nearly  6  minutes  before  the  airplane  hit  the 
water. 


These  recent  accidents  are  just  the  latest  in  a  long  history  of  accident  and  incident 
investigations  that  were  hindered  by  the  loss  of  flight  recorder  data  due  to  the  interruption  of 
aircraft  electrical  power.  The  following  list  contains  only  some  of  the  more  notable  accidents  for 
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which  vital  flight  recorder  information  was  not  available  because  of  a  premature  loss  of  electrical 
power: 

•  Overseas  National  Airways  (ONA)  flight  032,  a  DC-10-30;  JFK  Airport,  New  York; 
November  12,  1975.  During  the  takeoff  roll,  the  right  engine  ingested  a  large 
number  of  sea  gulls  and  disintegrated  causing  the  loss  of  electrical  power  to  the  flight 
data  recorder.  The  airplane  and  CVR  were  destroyed  by  the  postcrash  fire.  An  ONA 
employee  occupying  the  flight  deck  observer  seat  captured  the  takeoff  roll  on  a 
movie  camera  with  audio,  which  became  the  only  record  of  the  accident  sequence. 
There  were  no  fatalities  among  the  139  passengers  and  crew. 

•  Southern  Airways  flight  242,  a  DC-9-31;  New  Hope,  Georgia;  April  4,  1977. 
Following  the  airplane’s  penetration  of  a  level  6  thunderstorm,  both  engines  failed. 

The  pilots  attempted  a  dead-stick  landing  on  a  two-lane  highway.  Both  recorders 
stopped  following  the  engine  failures  and  did  not  resume  operation  until  2  minutes 
4  seconds  later,  when  the  auxiliary  power  unit  was  started.  There  were  62  fatalities 
and  23  survivors. 

•  American  Airlines  flight  191,  a  DC-10-10;  Chicago  O’Hare  Airport;  May  25,  1979. 

The  pylon  of  engine  No.  1  failed  during  takeoff  rotation,  after  which  the  engine 
separated  from  the  airplane,  removing  power  to  a  portion  of  the  DFDR  sensors  and 
the  CVR.  The  airplane  crashed  32  seconds  later.  There  were  no  survivors  among  the 
271  passengers  and  crew.  Two  people  on  the  ground  were  also  killed. 

•  United  Airlines  flight  81 1,  a  Boeing  747-122;  Honolulu,  Hawaii;  February  24,  1989. 
Engines  No.  3  and  4  were  shut  down  because  of  foreign  object  damage  from  the  right 
forward  cargo  door,  which  separated  causing  extensive  damage  to  the  fuselage  and 
adjacent  passenger  cabin.  The  CVR  was  lost  for  21.4  seconds  during  the  emergency 
descent  as  a  result  of  engine  shutdown.  There  were  nine  fatalities. 


Since  1983,'  there  have  been  52  accidents  and  incidents,  including  the  4  recent  accidents 
mentioned  above,  in  which  information  from  either  a  CVR  or  FDR  or  both  were  lost  due  to 
interruption  of  electrical  power  following  an  engine  or  generator  failure  or  crew  action.  Until 
recently,  recorder  technology  did  not  offer  a  practical  solution  to  the  problem  of  loss  of  electrical 
power  to  the  on-board  recorders.  However,  recent  innovations  in  recorder  and  power  supply 
technologies  have  made  it  possible  to  provide  an  independent  power  source  that  would  provide 
sufficient  power  to  operate  a  solid-state  flight  recorder  for  10  minutes. 

In  assessing  the  feasibility  of  an  independent  power  source,  strong  consideration  must  be 
given  to  reliability,  complexity,  maintainability,  and  cost.  The  independent  power  source  must 
also  automatically  engage  when  power  to  the  recorders  is  lost.  Older  model  tape-based  recorders 
require  too  much  electrical  power  and  are  not  easily  adapted  to  a  direct  current  (d.c.)  battery  or 
capacitor.  However,  the  relatively  low  power  requirements  of  solid-state  flight  recorders  (about 


1  Origin  date  of  the  Safety  Board’s  current  aviation  accident  database.  Data  prior  to  1983  are  incomplete. 
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10  to  12  watts  from  a  28-volt  d.c.  system)  would  permit  the  use  of  an  independent  power  source. 
Thus,  it  is  evident  that  the  use  of  an  independent  power  source  would  also  require  the  use  of 
solid-state  flight  recorders. 

The  replacement  of  magnetic  tape  flight  recorders  with  solid-state  flight  recorders  would 
not  appear  to  be  an  undue  burden  on  the  industry.  In  fact,  several  major  U.S.  air  carriers  have 
recognized  the  economic  benefits  of  solid-state  recorders  and  are  replacing  the  obsolete  tape 
flight  recorders  in  their  fleets  with  solid-state  units  solely  for  economic  reasons.  Further, 
replacement  units  exist  that  meet  the  latest  Technical  Standard  Order  (TSO)2  standards  and  that 
are  capable  of  recording  2  hours  of  CVR  audio. 

Other  factors  have  also  influenced  the  industry’s  movement  to  solid-state  flight  recorders. 
The  poor  survivability  and  performance  of  magnetic  tape  flight  recorders  in  recent  years  have 
raised  concerns  in  the  United  States  and  abroad  about  the  ability  of  that  medium  to  provide  data 
of  sufficient  quality  for  accident  and  incident  investigations.  In  several  recent  accidents,  the 
magnetic  tape  flight  recording  medium  was  destroyed  or  damaged  due  to  postaccident  fire  or 
water  immersion.  These  accidents  were  in  addition  to  those  that  lead  to  the  markedly  improved 
crash/fire  survivability  standards  in  TSOs  C123a  and  C124a.3 

Another  factor  is  that  the  future  serviceability  of  magnetic  tape  recorders  is  also  in  doubt. 
Of  the  tape  flight  recorders  received  by  the  Safety  Board  for  readout,  laboratory  staff  have  noted 
an  increase  in  the  number  of  tape  units  with  unreliable  data  and  units  that  are  partially  or 
completely  unserviceable.  The  Bureau  Enquetes-Accidents,  the  French  accident  investigation 
authority,  has  had  similar  experiences  and  is  developing  a  recommendation  that  would  ban  the 
Fairchild  F8004  magnetic  tape  flight  recorder  because  of  its  unreliability.  The  decline  in 
serviceability  is  reminiscent  of  the  serviceability  problems  experienced  during  the  final  years  of 
the  oscillographic  foil  flight  recorders. 

An  additional  consideration  is  the  fact  that  magnetic  tape  flight  recorders  are  no  longer  in 
production,  and  only  a  few  manufacturers  produce  the  precision  instrumentation  tape  decks 
needed  for  playback  of  tapes  recovered  from  accident-involved  recorders.  Some  recorder 
manufacturers  have  also  indicated  a  substantial  decrease  in  the  number  of  suppliers  of  tape 
recorder  parts  such  as  drive  motors  and  magnetic  heads.  One  manufacturer  predicts  that  its 
stockpile  of  magnetic  tape  may  be  depleted  by  2005. 

Another  significant  factor  that  would  warrant  the  industry  to  replace  magnetic  tape  flight 
recorders  with  solid-state  flight  recorders  involves  the  future  requirement  to  record  data  link 
communications.  In  about  2004  to  2005,  analog  CVRs  will  no  longer  meet  the  requirements  for 
aircraft  using  controller-pilot  data  link  (CPDL)  communications.  It  is  anticipated  that  future 
regulatory  changes  will  require  that  aircraft  using  CPDL  communications  be  fitted  with  solid- 


2  TSOs  detail  the  minimum  performance  standards  for  specified  articles — such  as  materials,  parts,  and 
appliances — used  on  civil  aircraft.  TSOs  are  issued  by  the  FAA  Administrator. 

3  The  TSOs  were  developed  in  response  to  the  Safety  Board’s  Safety  Recommendations  A-92-45  through  -48. 

4  L-3  Communications,  Inc.,  is  the  current  manufacturer  of  Fairchild  aviation  recorders. 
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state  CVRs  (SSCVRs)  that  can  record  data  link  messages.5  To  that  end,  the  Safety  Board 
encourages  the  industry  to  consider  for  future  CVR  installations  on  airplanes  using  controller- 
pilot  data  link  communications  that  the  CVRs  be  capable  of  recording  digital  data  link  messages. 

As  the  technology  and  application  of  data  link  communications  evolve,  the  industry  will 
also  need  to  consider  developing  the  capability  that  enables  qualified  ground  personnel  to 
perform  real-time  monitoring  of  the  flight  parameters  to  assist  the  flight  crew  when  an  in-flight 
problem  or  emergency  occurs.  Such  monitoring  will  require  a  communications  network  that  is 
capable  of  transmitting  real-time  flight  data  to  qualified  ground  personnel. 

Current  regulations  call  for  a  CVR  with  a  minimum  30-minute  recording  duration.  This 
minimum  requirement  was  based  on  the  limitations  of  1960s  recorder  technology,  which  was 
constrained  by  the  amount  of  magnetic  tape  that  could  be  impact/fire  protected.  In  the  years 
since  CVRs  became  mandatory,  the  Safety  Board  has  investigated  many  accidents  and  incidents 
for  which  the  30-minute  CVR  recording  was  not  sufficient  to  retain  key  events.  This  prompted 
the  Safety  Board  to  recommend  in  1996  that  all  newly  manufactured  CVRs  be  SSCVRs  with  a 
2-hour  recording  duration  (Safety  Recommendation  A-96-171).6  Accident  investigations  in 
which  the  Safety  Board  has  participated  subsequent  to  the  issuance  of  Safety  Recommendation 
A-96-171  continue  to  demonstrate  that  a  lack  of  recorded  voice  and  other  aural  information  can 
inhibit  safety  investigators  and  delay  or  prevent  the  identification  of  safety  deficiencies. 

The  CVR  installed  on  Swissair  flight  1 1 1  used  a  continuous-loop  magnetic  tape  with  a 
30-minute  duration.  The  earliest  information  on  the  CVR  tape  was  recorded  about  15  minutes 
before  the  crew  noted  an  unusual  odor.  Crew  conversations  and  cockpit  sounds  prior  to  the 
beginning  of  this  30-minute  recording  might  have  provided  insight  into  any  initiating  or 
precursory  events  that  led  to  the  accident. 

About  38  minutes  prior  to  the  crew  noting  an  unusual  odor,  Boston  Center7  issued 
flight  111  a  radio  frequency  change.  During  the  following  13  minutes,  Boston  Center  made 
repeated  attempts  to  contact  flight  111  but  did  not  establish  contact.  Any  cockpit  conversations, 
flight  deck  noises,  or  attempted  crew  transmissions  that  occurred  during  this  period  were 
subsequently  overwritten  on  the  CVR,  and  thus  were  not  available  to  the  accident  investigators. 

Although  30-minute  magnetic  tape  CVRs  are  no  longer  being  manufactured,  units  still 
exist  and  could  be  installed  on  aircraft  today.  Given  the  continued  need  for  longer  periods  of 
recorded  sound  to  capture  the  initiating  events  of  aviation  accidents,  and  the  availability  of  and 
trend  toward  2-hour  CVRs,  the  Safety  Board  believes  that  a  retrofit  program  is  warranted. 
Therefore,  the  Safety  Board  believes  that  the  Federal  Aviation  Administration  (FAA)  should 
require  the  retrofit  after  January  1,  2005,  of  all  CVRs  on  all  airplanes  required  to  carry  both  a 


5  The  FAA  has  indicated  that  it  will  initiate  rulemaking  to  clarify  that  the  present  requirement  to  record  all  voice 
messages  be  expanded  to  include  cockpit  data  messages.  According  to  the  FAA,  the  rulemaking  is  expected  to  take 
effect  about  2004. 

6  The  current  status  of  Safety  Recommendation  A-96-171  is  “Open — Acceptable  Response.” 

7  Boston  Center  is  an  FAA  Air  Route  Traffic  Control  Center  (ARTCC). 
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CVR  and  a  FDR  with  a  CVR  that  meets  TSO  Cl 23 a  and  is  capable  of  recording  the  last  2  hours 
of  audio. 

Although  a  number  of  options  were  identified  for  assessing  the  feasibility  of  an 
independent  power  source,  a  capacitor  appears  to  be  the  most  effective  means  of  providing  an 
independent  power  source.  The  capacitor  method  would  provide  a  power  source  that  requires 
very  little  maintenance,  and,  unlike  a  rechargeable  battery,  the  capacitor  method  would  not 
C  require  any  power  sensing  circuitry  for  normal  operation.  To  maximize  recorder  reliability  and 

to  minimize  any  crew  intervention,  the  independent  power  source  should  automatically  engage 
t  whenever  the  normal  electrical  power  to  the  recorder  ceases,  even  when  the  aircraft  is  powered 

down  normally.  To  increase  the  probability  of  recording  accident  data,  the  independent  power 
source  should  be  capable  of  powering  the  recorder  for  10  minutes  after  main  power  to  the 
recorder  shuts  off. 

For  a  DFDR,  an  independent  power  source  would  not  necessarily  enable  the  recording  of 
any  additional  information.  Backup  power  to  a  DFDR  would  result  only  in  the  recording  of  data 
from  sensors  that  are  still  powered  and  can  relay  that  information  to  the  DFDR.  If  aircraft  power 
is  lost,  the  probability  is  small  that  the  sensors  and  data  acquisition  unit  would  still  be  receiving 
power  or  be  able  to  relay  that  data  to  the  DFDR.  However,  in  the  case  of  a  CVR,  the  area 
microphone  is  powered  by  the  CVR;  as  long  as  the  CVR  receives  power,  the  area  microphone 
will  continue  to  operate  and  the  CVR  will  continue  to  record  sounds  from  the  area  microphone, 
provided  that  the  connection  between  the  microphone  and  the  recorder  is  not  compromised.  In 
the  case  of  the  SilkAir  accident,  the  2-hour  SSCVR  stopped  recording  5  minutes  58  seconds 
prior  to  the  DFDR  stopping,  which  stopped  1  minute  54  seconds  prior  to  impact.  Thus,  any 
valuable  dialog  in  the  cockpit  regarding  the  airplane  status  for  those  7  minutes  52  seconds  was 
lost. 

However,  providing  a  30-minute  CVR  with  10  minutes  of  independent  power  after  main 
power  ceases  would  result  in  about  one-third  of  the  in-flight  audio  being  recorded  over.  Thus,  it 
would  not  be  acceptable  to  fit  30-minute  CVRs  with  an  independent  power  supply  that 
automatically  engages  when  aircraft  electrical  power  is  terminated  for  any  reason. 

With  maintenance-free  independent  power  sources,  it  is  now  feasible  to  provide  an 
independent  power  source  for  new-technology  CVRs  for  a  specific  period  of  time,  in  the  event 
r  that  aircraft  power  sources  to  the  CVR  are  interrupted  or  lost.  Therefore,  the  Safety  Board 

believes  that  for  the  CVR  retrofit  after  January  1,  2005,  the  FAA  should  also  require  the  CVR  to 
be  provided  with  an  independent  power  source  that  is  located  with  the  CVR  and  that  automatically 
engages  and  provides  10  minutes  of  operation  whenever  aircraft  power  to  the  recorder  ceases,  either 
by  normal  shutdown  or  by  a  loss  of  power  to  the  bus. 

The  Canadian  TSB  shares  the  view  that  a  CVR  retrofit  is  warranted  and  has  developed  a 
similar  recommendation,  which  was  issued  to  the  Canadian  and  European  regulators  in  early 
March  1999.  The  Safety  Board  and  the  TSB  hope  that  the  actions  recommended  by  the  two 
investigative  authorities  are  adopted  by  civil  aviation  regulators  worldwide. 
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The  Safety  Board  recognizes  that  in  the  case  of  ValuJet  flight  592  and  TWA  flight  800, 
the  microphone  wiring  may,  in  fact,  have  been  compromised  and,  consequently,  the 
implementation  of  this  retrofit  would  probably  not  have  materially  benefited  the  investigation  of 
those  accidents.  However,  other  changes  that  are  discussed  in  the  following  paragraphs — such  as 
dual  combination  recording  systems,  with  one  being  placed  as  close  to  the  cockpit  as  possible — 
could  have  resulted  in  obtaining  additional  critical  information.  , 

As  discussed  earlier,  it  would  not  be  practical  to  provide  FDRs  with  an  independent 
power  source.  However,  if  the  FDR  were  part  of  a  dual  combination  voice  and  data  recorder 
system,  an  independent  power  source  should  be  installed.  Combination  recorders  are  now 
available  and  provide  the  functions  of  both  a  DFDR  and  a  CVR  in  a  solid-state  format;  they  do 
not  require  more  space  than  the  current  DFDR  models;  they  weigh  less  than  the  combined 
weights  of  a  DFDR  and  a  CVR;  and  they  cost  less  than  the  combined  costs  of  a  DFDR  and  a 
CVR.  In  addition,  combination  recorders  will  allow  for  the  use  of  dual  redundant  recorders,  with 
one  recorder  located  in  close  proximity  to  the  cockpit  to  reduce  the  possibility  of  signal  loss,  and 
one  as  far  aft  as  practicable  to  enhance  survivability. 

One  particular  problem  that  has  occurred  in  several  accidents,  such  as  ValuJet  flight  592 
and  TWA  flight  800,  is  that  either  the  aircraft’s  electrical  power  bus  had  been  severed  or  the 
signal  wires  connecting  the  CVR/DFDR  to  the  aircraft’s  sensors  had  been  compromised.  The 
CVR  and  DFDR  are  intentionally  located  in  the  rear  of  the  aircraft  for  greater  survivability.  This 
rear  mounting  usually  results  in  long  cable  runs  from  the  forward  cockpit  areas  to  the  recorders. 

One  option  for  mitigating  the  risks  to  both  recorder  and  cable  survivability  would  be  to  locate 
one  combination  recorder  in  the  rear  of  the  aircraft  and  another  combination  recorder  near  or  in 
the  cockpit  of  the  aircraft.  This  installation  would  virtually  eliminate  the  vulnerability  of  the 
signal  wires  to  external  damage.  As  a  result,  the  probability  of  the  loss  of  power  to  the 
combination  recorder  due  to  an  in-flight  fire  or  breakup  would  decrease.  The  additional, 
forward-mounted  combination  recorder  would  also  be  fitted  with  an  independent  power  source; 
consequently,  if  primary  aircraft  power  were  lost,  the  independent  power  source  would  further 
ensure  that  the  combination  recorder  continued  to  record  via  the  cockpit  area  microphone. 

i 

Therefore,  the  Safety  Board  believes  that  the  FAA  should  require  all  aircraft 
manufactured  after  January  1,  2003,  that  must  carry  both  a  CVR  and  a  DFDR  to  be  equipped 
with  two  combination  (CVR/DFDR)  recording  systems.  One  system  should  be  located  as  close  ^ 

to  the  cockpit  as  practicable  and  the  other  as  far  aft  as  practicable.  Both  recording  systems 
should  be  capable  of  recording  all  mandatory  data  parameters  covering  the  previous  25  hours  of 
operation  and  all  cockpit  audio  including  CPDL  messages  for  the  previous  2  hours  of  operation. 

The  system  located  near  the  cockpit  should  be  provided  with  an  independent  power  source  that  is 
located  with  the  combination  recorder,  and  that  automatically  engages  and  provides  10  minutes 
of  operation  whenever  normal  aircraft  power  ceases,  either  by  normal  shutdown  or  by  a  loss  of 
power  to  the  bus.  The  aft  system  should  be  powered  by  the  bus  that  provides  the  maximum 
reliability  for  operation  without  jeopardizing  service  to  essential  or  emergency  loads,  whereas  the 
system  near  the  cockpit  should  be  powered  by  the  bus  that  provides  the  second  highest  reliability 
for  operation  without  jeopardizing  service  to  essential  or  emergency  loads. 
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Until  recently,  it  has  been  the  general  practice  of  aircraft  manufacturers  to  use  different 
aircraft  electrical  buses  to  provide  power  to  the  CVR  and  FDR;  however,  there  has  never  been  a 
requirement  to  do  so.  Current  regulations  call  for  power  only  from  an  electrical  bus  that  provides 
the  maximum  reliability  for  operation  without  jeopardizing  service  to  essential  or  emergency 
loads.  As  a  result,  MD-1 1  airplanes,  which  are  currently  configured  with  the  CVR  and  FDR  on 
the  same  generator  bus,  meet  all  regulatory  requirements.  However,  with  this  configuration  on 
MD-1 1  airplanes,  such  as  Swissair  flight  1 1 1,  the  failure  or  disabling  of  that  bus  would  cause  the 
loss  of  both  flight  recorders.  Consequently,  the  Safety  Board  believes  that  CVRs,  FDRs,  and 
redundant  combination  flight  recorders  should  be  powered  from  separate  generator  buses. 
Therefore,  the  Board  believes  that  the  FAA  should  amend  Title  14  Code  of  Federal  Regulations 
Parts  25.1457  (cockpit  voice  recorders)  and  25.1459  (flight  data  recorders)  to  require  that  CVRs, 
FDRs,  and  redundant  combination  flight  recorders  be  powered  from  separate  generator  buses 
with  the  highest  reliability.  The  Canadian  TSB  has  developed  a  similar  recommendation,  which 
was  issued  to  the  Canadian  and  European  regulators  in  early  March  1999. 

In  its  report  on  a  September  8,  1989,  incident  involving  USAir  flight  105,  a  Boeing  737, 
at  Kansas  City,  Missouri,  the  Safety  Board  cited  the  need  for  a  video  recording  of  the  cockpit 
environment.8  The  report  pointed  out  the  limitations  of  existing  flight  recorders  to  fully 
document  the  range  of  the  flight  crew  actions  and  communications.  It  also  noted  that  the 
introduction  of  aircraft  with  electronic  “glass”  cockpits  and  the  future  use  of  CPDL 
communications  would  enable  the  flight  crew  to  make  display  and  data  retrieval  selections  that 
will  be  transparent  to  the  CVR  and  FDR.  The  Safety  Board  indicated  that  it  would  monitor  and 
evaluate  progress  in  the  application  of  video  technology  to  the  cockpits  of  air  transports.  In  the 
9  years  since  that  incident,  considerable  progress  has  been  made  in  video  and  flight  recorder 
technologies,  and  the  need  for  video  recording  is  becoming  more  evident.  Video  recording  of  the 
cockpit  environment  on  newly  manufactured  airplanes  is  now  technologically  and  economically 
feasible,  and  interest  in  video  recording  is  growing. 

The  international  aviation  community  is  aware  of  the  safety  benefits  of  crash-protected 
video  recorders.  Agenda  item  3  of  ICAO’s  FLIRECP/29  specifically  dealt  with  the  need  for 
standards  and  recommended  practices  (SARPs)  concerning  video  recordings.  The  panel  agreed 
that  the  use  of  video  recordings  in  the  aircraft  cockpits  would  be  very  useful  and  noted  that 
EUROCAE10  was  developing  minimum  operational  performance  specifications  (MOPs).  The 
panel  agreed  that  video  technology  was  maturing  to  the  point  where  specific  technical  aspects 
(for  example,  video  frame  rate,  number  of  cameras,  and  resolution  per  frame)  must  be 
determined,  and  that  the  ongoing  work  of  EUROCAE  and  ARINC11  should  be  considered  when 
developing  video  recorder  SARPs.  The  panel  concluded  that  it  was  “strongly  committed  to  the 


*  National  Transportation  Safety  Board.  1990.  USAir  Flight  105;  Boeing  737-200,  N283AU;  Kansas  City 
International  Airport,  Missouri;  September  8,  1989.  Aircraft  Incident  Report  NTSB/AAR-90/04. 

9  International  Civil  Aviation  Organization  (ICAO),  Flight  Recorder  Panel  second  meeting  (FLIRECP/2). 

10  European  Organisation  for  Civil  Aviation  Equipment  (EUROCAE). 

1 1  ARINC,  located  in  Annapolis,  Maryland,  is  a  private  corporation  whose  principal  stockholders  are 
international  air  carriers.  ARINC  provides  the  aviation  industry  with  communications  and  information  processing 
systems  and  services,  system  engineering,  and  standards. 
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introduction  of  video  recordings  in  an  appropriate  and  agreed  format,  and  that  this  should  form 
part  of  the  future  work  of  the  panel.” 

EUROCAE  Working  Group  50  (WG50)  began  drafting  the  fundamental  needs  for  video 
recorders  at  its  February  1999  meeting,  which  was  attended  by  recorder  manufacturers, 
regulatory  authorities,  and  accident  investigators  from  around  the  world,  including  the  Safety 
Board  and  the  FAA.  The  fundamental  needs  for  video  recording  are  expected  to  be  completed  at 
the  next  meeting  of  WG50  in  June  1999.  Although  WG50  remains  committed  to  the  task  of 
defining  standards  for  video  flight  recorders,  it  has  not  yet  projected  a  completion  date  for  a 
MOP. 


The  Safety  Board  believes  that  recorder  systems  and  standard-setting  processes  should  be 
flexible  enough  to  incorporate  new  technology  as  it  is  developed.  To  that  end,  the  Safety  Board 
encourages  the  FAA  and  the  aviation  industry  to  take  steps  such  as  prewiring  aircraft,  developing 
system  interfaces,  and  developing  technical  standards  to  facilitate  the  eventual  introduction  of 
new  technology,  such  as  video  recorders. 

Therefore,  the  National  Transportation  Safety  Board  recommends  that  the  Federal 
Aviation  Administration: 

Require  retrofit  after  January  1,  2005,  of  all  cockpit  voice  recorders  (CVRs)  on  all 
airplanes  required  to  carry  both  a  CVR  and  a  flight  data  recorder  (FDR)  with  a 
CVR  that  (a)  meets  Technical  Standard  Order  (TSO)  Cl 23a,  (b)  is  capable  of 
recording  the  last  2  hours  of  audio,  and  (c)  is  fitted  with  an  independent  power 
source  that  is  located  with  the  digital  CVR  and  that  automatically  engages  and 
provides  10  minutes  of  operation  whenever  aircraft  power  to  the  recorder  ceases, 
either  by  normal  shutdown  or  by  a  loss  of  power  to  the  bus.  (A-99-16) 

Require  all  aircraft  manufactured  after  January  1,  2003,  that  must  carry  both  a 
cockpit  voice  recorder  (CVR)  and  a  digital  flight  data  recorder  (DFDR)  to  be 
equipped  with  two  combination  (CVR/DFDR)  recording  systems.  One  system 
should  be  located  as  close  to  the  cockpit  as  practicable  and  the  other  as  far  aft  as 
practicable.  Both  recording  systems  should  be  capable  of  recording  all  mandatory 
data  parameters  covering  the  previous  25  hours  of  operation  and  all  cockpit  audio 
including  controller-pilot  data  link  messages  for  the  previous  2  hours  of 
operation.  The  system  located  near  the  cockpit  should  be  provided  with  an 
independent  power  source  that  is  located  with  the  combination  recorder,  and  that 
automatically  engages  and  provides  10  minutes  of  operation  whenever  normal 
aircraft  power  ceases,  either  by  normal  shutdown  or  by  a  loss  of  power  to  the  bus. 

The  aft  system  should  be  powered  by  the  bus  that  provides  the  maximum 
reliability  for  operation  without  jeopardizing  service  to  essential  or  emergency 
loads,  whereas  the  system  near  the  cockpit  should  be  powered  by  the  bus  that 
provides  the  second  highest  reliability  for  operation  without  jeopardizing  service 
to  essential  or  emergency  loads.  (A-99-17) 
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Amend  Title  14  Code  of  Federal  Regulations  Parts  25.1457  (cockpit  voice 
recorders)  and  25.1459  (flight  data  recorders)  to  require  that  CYRs,  FDRs,  and 
redundant  combination  flight  recorders  be  powered  from  separate  generator  buses 
with  the  highest  reliability.  (A-99-18) 


If  you  have  any  questions  about  the  recommendations,  you  may  call  (202)  3 1 4-6522. 

C/  Chairman  HALL,  Vice  Chairman  FRANCIS,  and  Members  HAMMERSCHMIDT, 

GOGLIA,  and  BLACK  concurred  in  these  recommendations. 


Chairman 


